Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
firefox_preferences
Get the filepath where the host's Firefox preferences live.
Column | Type | Description |
---|---|---|
fullkey | text | The expanded name of the specific item that describes the path. |
key | text | A specific item that describes the path. |
parent | text | The key's parent. |
path | text | The absolute path to the host's Firefox preferences. Required in WHERE clause |
query | text | The query is printed in this column. For example the SQL SELECT * FROM firefox_preferences WHERE path = 'testdata/prefs.js' will print "*" in the query column. |
value | text | The value for the specified key. |
Check if a preference is enabled:
SELECT * FROM firefox_preferences WHERE path IN (SELECT path FROM file WHERE path LIKE '/home/%/.mozilla/firefox/%/prefs.js') AND fullkey = 'network.dns.disablePrefetch' and value = 'true';
This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by Kolide.