Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

quicklook_cache

Files and thumbnails within macOS's Quicklook Cache.

Column	Type	Description
cache_path	text	Path to cache data
fs_id	text	Quicklook file fs_id key
hit_count	text	Number of cache hits on thumbnail
icon_mode	bigint	Thumbnail icon mode
inode	integer	Parsed file ID (inode) from fs_id
label	text	Parsed version 'gen' field
last_hit_date	integer	Apple date format for last thumbnail cache hit
mtime	integer	Parsed version date field
path	text	Path of file
rowid	integer	Quicklook file rowid key
size	bigint	Parsed version size field
volume_id	integer	Parsed volume ID from fs_id