Tables
Tables{{numberOfTablesDisplayed}}
keychain_items
Generic details about keychain items. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.
| Column | Type | Description |
|---|---|---|
| account | text | Optional item account |
| comment | text | Optional keychain comment |
| created | text | Date item was created |
| description | text | Optional item description |
| label | text | Generic item name |
| modified | text | Date of last modification |
| path | text | Path to keychain containing item |
| pk_hash | text | Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2) |
| type | text | Keychain item type (class) |
Example
Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)
SELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';Notes
- This table should be used sparingly as it uses an Apple API which occasionally corrupts the underlying certificate. Learn more here.
Edit page
Need more help?
Ask the community on Slack
SOC2 Type 2
© 2024 Fleet Inc.
Privacy
