Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
hash
hash
Filesystem hash data.
| Column | Type | Description |
|---|---|---|
| directory | text | Must provide a path or directory Required in WHERE clause |
| md5 | text | MD5 hash of provided filesystem data |
| mount_namespace_id | text | Mount namespace id Only available on Linux |
| path | text | Must provide a path or directory Required in WHERE clause |
| pid_with_namespace | integer | Pids that contain a namespace Only available on Linux |
| sha1 | text | SHA1 hash of provided filesystem data |
| sha256 | text | SHA256 hash of provided filesystem data |
Example
List zip files in the downloads folder as well as their associated sha256 hash.
SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
