Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

package_install_history

The package_install_history table provides a detailed log of all packages installled on macOS.

Column	Type	Description
content_type	text	Package content_type (optional)
name	text	Package display name
package_id	text	Label packageIdentifiers
source	text	Install source: usually the installer process name
time	integer	Label date as UNIX timestamp
version	text	Package display version

Example

Basic query:

SELECT name,package_id,version,source,datetime(time,'unixepoch') AS install_time FROM package_install_history WHERE install_time >= datetime('now','-7 days');

This query fetches the following data for a macOS package:

Name
Package ID
Version
Source
Install time

The WHERE clause filters the results to show only packages installed in the past 7 days.

Notes

Monitoring the macOS package install history is useful for:

Regularly checking for newly installed packages and identifying suspicious software
Verifying that only approved packages are installed
Creating a Fleet policy to receive alerts for any unauthorized or vulnerable installations

Apple’s installer package documentation

Edit page