Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
file
file
Interactive filesystem attributes and metadata.
| Column | Type | Description |
|---|---|---|
| atime | bigint | Last access time |
| attributes | text | File attrib string. See: https://ss64.com/nt/attrib.html Only available on Windows |
| block_size | integer | Block size of filesystem |
| bsd_flags | text | The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND Only available on macOS |
| btime | bigint | (B)irth or (cr)eate time |
| ctime | bigint | Last status change time |
| device | bigint | Device ID (optional) |
| directory | text | Directory of file(s) Required in WHERE clause |
| file_id | text | file ID Only available on Windows |
| file_version | text | File version Only available on Windows |
| filename | text | Name portion of file path |
| gid | bigint | Owning group ID |
| hard_links | integer | Number of hard links |
| inode | bigint | Filesystem inode number |
| mode | text | Permission bits |
| mount_namespace_id | text | Mount namespace id Only available on Linux |
| mtime | bigint | Last modification time |
| original_filename | text | (Executable files only) Original filename Only available on Windows |
| path | text | Absolute file path Required in WHERE clause |
| pid_with_namespace | integer | Pids that contain a namespace Only available on Linux |
| product_version | text | File product version Only available on Windows |
| shortcut_comment | text | Comment on the shortcut Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_run | text | Window mode the target of the shortcut should be run in Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_start_in | text | Full path to the working directory to use when executing the shortcut target Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_location | text | Folder name where the shortcut target resides Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_path | text | Full path to the file the shortcut points to Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_type | text | Display name for the target type Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| size | bigint | Size of file in bytes |
| symlink | integer | 1 if the path is a symlink, otherwise 0 |
| symlink_target_path | text | Full path of the symlink target if any |
| type | text | File status |
| uid | bigint | Owning user ID |
| volume_serial | text | Volume serial number Only available on Windows |
Example
List zip files in the downloads folder as well as their associated sha256 hash.
SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
