Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

platform_info

The platform_info osquery table collects boot platform information from a computer. The platform_info table works on Linux, macOS and Windows.

Column	Type	Description
address	text	Relative address of firmware mapping Only available on Linux and macOS
date	text	Self-reported platform code update date
extra	text	Platform-specific additional information
firmware_type	text	The type of firmware (uefi, bios, iboot, openfirmware, unknown).
revision	text	BIOS major and minor revision
size	text	Size in bytes of firmware Only available on Linux and macOS
vendor	text	Platform code vendor
version	text	Platform code version
volume_size	integer	(Optional) size of firmware volume Only available on Linux and macOS

Basic query:

SELECT extra,firmware_type,vendor FROM platform_info;

This query results in a listing of the following attributes on a macOS host running a Windows 11 virtual machine in the Parallels.app:

Mac -

extra = "Darwin Kernel Version 23.5.0: Wed May 1 20:14:38 PDT 2024; root:xnu-10063.121.3~5/RELEASE_ARM64_T6020"
firmware_type = "iboot"
vendor = "Apple Inc."

Windows -