Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

process_file_events

A File Integrity Monitor implementation using the audit service.

Column	Type	Description
auid	text	Audit user ID of the process using the file
cwd	text	The current working directory of the process
dest_path	text	The canonical path associated with the event
egid	text	Effective group ID of the process using the file
eid	text	Event ID *Not returned in `SELECT FROM process_file_events`.**
euid	text	Effective user ID of the process using the file
executable	text	The executable path
fsgid	text	Filesystem group ID of the process using the file
fsuid	text	Filesystem user ID of the process using the file
gid	text	The gid of the process performing the action
operation	text	Operation type
partial	text	True if this is a partial event (i.e.: this process existed before we started osquery)
path	text	The path associated with the event
pid	bigint	Process ID
ppid	bigint	Parent process ID
sgid	text	Saved group ID of the process using the file
suid	text	Saved user ID of the process using the file
time	bigint	Time of execution in UNIX time
uid	text	The uid of the process performing the action
uptime	bigint	Time of execution in system uptime