Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

programs

The programs table lists applications installed via Windows Installer from a package.

Column	Type	Description
identifying_number	text	Product identification such as a serial number on software, or a die number on a hardware chip.
install_date	text	Date that this product was installed on the system.
install_location	text	The installation location directory of the product.
install_source	text	The installation source of the product.
language	text	The language of the product.
name	text	Commonly used product name.
package_family_name	text	A combination of PackageName and PublisherHash that is used to uniquely identify applications across versions and architectures.
publisher	text	Name of the product supplier.
uninstall_string	text	Path and filename of the uninstaller.
upgrade_code	text	Specific to MSI applications, a GUID used to identify a product suite across multiple versions.
version	text	Product version information.

Basic query:

SELECT * FROM programs;

This query determines if a specific version of Google Chrome.exe is installed:

SELECT name,version FROM programs WHERE name='Google Chrome' AND version='125.0.6422.142';

This table includes references for applications:

downloaded directly from websites and installed by an end user like Google Chrome or Notepad++
installed via automation frameworks like winget or Chocolatey
installed via command line in cmd or PowerShell

Links: