We’re launching free support for BYOD Android devices and looking for early feedback. Interested?
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
keychain_items
Generic details about keychain items. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.
Column | Type | Description |
---|---|---|
account | text | Optional item account |
comment | text | Optional keychain comment |
created | text | Date item was created |
description | text | Optional item description |
label | text | Generic item name |
modified | text | Date of last modification |
path | text | Path to keychain containing item |
pk_hash | text | Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2) |
type | text | Keychain item type (class) |
Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)
SELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';