Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
keychain_items
keychain_items
Generic details about keychain items. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.
| Column | Type | Description |
|---|---|---|
| account | text | Optional item account |
| comment | text | Optional keychain comment |
| created | text | Date item was created |
| description | text | Optional item description |
| label | text | Generic item name |
| modified | text | Date of last modification |
| path | text | Path to keychain containing item |
| pk_hash | text | Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2) |
| type | text | Keychain item type (class) |
Example
Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)
SELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';Notes
- This table should be used sparingly as it uses an Apple API which occasionally corrupts the underlying certificate. Learn more here.
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
