Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
dscl
Returns the output of the dscl . -read
command (local domain).
Column | Type | Description |
---|---|---|
command | text | The dscl command to execute, only "read" is currently supported. Required in WHERE clause |
key | text | The key to query on the read command and path. Required in WHERE clause |
path | text | The path to use in the read command. Required in WHERE clause |
value | text | The value of the read path and key. The value is the empty string if the key doesn't exist. |
This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).