Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
logged_in_users
logged_in_users
Users with an active shell on the system.
| Column | Type | Description |
|---|---|---|
| host | text | Remote hostname |
| pid | integer | Process (or thread) ID |
| registry_hive | text | HKEY_USERS registry hive Only available on Windows |
| sid | text | The user's unique security identifier Only available on Windows |
| time | bigint | Time entry was made |
| tty | text | Device name |
| type | text | Login type |
| user | text | User login name |
Example
See the user currently logged in on the console of the computer.
SELECT user, type, tty from logged_in_users WHERE tty='console';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
