Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
file_lines
Allows reading an arbitrary file.
Column | Type | Description |
---|---|---|
line | text | Output of the file, line by line. |
path | text | Path of the file to read. Required in WHERE clause |
Output the content of /etc/hosts
line by line.
SELECT * FROM file_lines WHERE path='/etc/hosts';
This table is from the Mac Admins osquery extension.