Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
filevault_users
Information on the users able to unlock the current boot volume if protected with FileVault.
Column | Type | Description |
---|---|---|
username | text | Username of the FileVault user. |
uuid | text | UUID of the FileVault user, which can be joined to users.uuid. |
List the usernames able to unlock and boot a computer protected by FileVault, joined to users.username to obtain the description of the operating system account that owns it.
SELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;
This table is from the Mac Admins osquery extension.