Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

event_taps

Returns information about installed event taps.

Column	Type	Description
enabled	integer	Is the Event Tap enabled
event_tap_id	integer	Unique ID for the Tap
event_tapped	text	The mask that identifies the set of events to be observed.
process_being_tapped	integer	The process ID of the target application
tapping_process	integer	The process ID of the application that created the event tap.

Example

Identify processes that have a tap into the system, such as access to keystrokes, and view details on the executable including signature status, team identifier if signed and the authority that emitted the signing certificate. This can be used to detect keyloggers and other malicious applications.

SELECT t.event_tapped, s.identifier, s.signed, s.team_identifier, s.authority FROM event_taps t JOIN processes p ON p.pid = t.tapping_process JOIN signature s on s.path = p.path WHERE s.identifier !='com.apple.ViewBridgeAuxiliary' AND s.identifier !='com.apple.universalaccessd' AND s.identifier !='com.apple.accessibility.AXVisualSupportAgent';

Edit page