Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
macos_user_profiles
High level information on installed user profiles enrollment.
Column | Type | Description |
---|---|---|
description | text | The description of the profile. |
display_name | text | The display name of the profile. |
identifier | text | The identifier of the profile. |
install_date | text | Date and time at which the profile was installed. |
organization | text | The profile's organization value. |
type | text | The type of profile. |
username | text | The username for which the profile is installed. Required in WHERE clause |
uuid | text | The UUID of the profile. |
verification_state | text | The verification state of the profile. |
Identify all profiles for user 'alice'. A single username equality condition is always required.
SELECT display_name, install_date FROM macos_user_profiles WHERE username='alice';
This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).