Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

etc_hosts

The hosts file comprises a local, plain-text configuration for mapping IP addresses to host names. It does not necessarily rely on an external Domain Name System (DNS) for routing. The etc_hosts osquery table expresses the data in the hosts file.

Column	Type	Description
address	text	IP address mapping
hostnames	text	Raw hosts mapping
pid_with_namespace	integer	Pids that contain a namespace Only available on Linux

Example

This query detects if the macOS /private/etc/hosts file has been modified from its default state:

SELECT * FROM etc_hosts WHERE address != '127.0.0.1' AND address != '::1' AND address != '255.255.255.255';

Notes

The hosts file is customized by many organizations. As part of a defense-in-depth security posture it's important to track hosts modifications. Endpoints with a modified hosts configuration connected to enterprise networks can potentially bypass network rules, proxies and firewalls or be routed to malicious sites.

File paths to hosts: