Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

dns_resolvers

Resolvers used by this host.

Column	Type	Description
address	text	Resolver IP/IPv6 address
id	integer	Address type index or order
netmask	text	Address (sortlist) netmask length
options	bigint	Resolver options
pid_with_namespace	integer	Pids that contain a namespace Only available on Linux
type	text	Address type: sortlist, nameserver, search

Example

Identify computers that are using an external DNS server instead of an internal one. This query also removes null and empty strings that can be returned by this table.

SELECT address FROM dns_resolvers WHERE type='nameserver' AND address NOT LIKE '192.168%%' AND address NOT LIKE '172.16%%' AND address NOT LIKE '172.17%%' AND address NOT LIKE '172.18%%' AND address NOT LIKE '172.19%%' AND address NOT LIKE '172.20%%' AND address NOT LIKE '172.21%%' AND address NOT LIKE '172.22%%' AND address NOT LIKE '172.23%%' AND address NOT LIKE '10.%%'  AND address NOT LIKE '127.%%' AND address IS NOT NULL AND address IS NOT ' ' AND address IS NOT '';

Edit page