Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

disk_events

disk_events EVENTED TABLE

Track DMG disk image events (appearance/disappearance) when opened.

Column	Type	Description
action	text	Appear or disappear
checksum	text	UDIF Master checksum if available (CRC32)
content	text	Disk event content
device	text	Disk event BSD name
eid	text	Event ID *Not returned in `SELECT FROM disk_events`.**
ejectable	integer	1 if ejectable, 0 if not
filesystem	text	Filesystem if available
media_name	text	Disk event media name string
mountable	integer	1 if mountable, 0 if not
name	text	Disk event name
path	text	Path of the DMG file accessed
size	bigint	Size of partition in bytes
time	bigint	Time of appearance/disappearance in UNIX time
uuid	text	UUID of the volume inside DMG if available
vendor	text	Disk event vendor string
writable	integer	1 if writable, 0 if not

Example

This is an evented table, and as such, is more useful if you are sending osquery logs to a SIEM or other centralized destination via Fleet. Events must be enabled. This query will contain the list of all actions related to connecting and removing disks, including SMB drives and USB storage, which can be very useful for investigative purposes.