Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
disk_encryption
disk_encryption
Disk encryption status and information.
| Column | Type | Description |
|---|---|---|
| encrypted | integer | 1 If encrypted: true (disk is encrypted), else 0 |
| encryption_status | text | Disk encryption status with one of following values: encrypted | not encrypted | undefined |
| filevault_status | text | FileVault status with one of following values: on | off | unknown Only available on macOS |
| name | text | Disk name |
| type | text | Description of cipher type and mode if available |
| uid | text | Currently authenticated user if available Only available on macOS |
| user_uuid | text | UUID of authenticated user if available Only available on macOS |
| uuid | text | Disk Universally Unique Identifier |
Example
A policy query to check if Filevault disk encryption is enabled on a Mac.
SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT '' AND filevault_status = 'on' LIMIT 1;
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
