Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

dscl

Returns the output of the dscl . -read command (local domain).

Column	Type	Description
command	text	The dscl command to execute, only "read" is currently supported. Required in `WHERE` clause
key	text	The key to query on the read command and path. Required in `WHERE` clause
path	text	The path to use in the read command. Required in `WHERE` clause
value	text	The value of the read path and key. The value is the empty string if the key doesn't exist.