Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
docker_container_fs_changes
Changes to files or directories on container's filesystem.
Column | Type | Description |
---|---|---|
change_type | text | Type of change: C:Modified, A:Added, D:Deleted |
id | text | Container ID Required in WHERE clause |
path | text | FIle or directory path relative to rootfs |
select * from docker_container_fs_changes where id = '11b2399e1426d906e62a0c357650e363426d6c56dbe2f35cbaa9b452250e3355'