Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

device_partitions

Use TSK to enumerate details about partitions on a disk device.

Column	Type	Description
blocks	bigint	Number of blocks
blocks_size	bigint	Byte size of each block
device	text	Absolute file path to device node Required in `WHERE` clause
flags	integer	Value that describes the partition (TSK_VS_PART_FLAG_ENUM)
inodes	bigint	Number of meta nodes
label	text	The partition name as stored in the partition table
offset	bigint	Byte offset from the start of the volume
partition	integer	A partition number or description
type	text	Filesystem type if recognized, otherwise, 'meta', 'normal', or 'unallocated'