Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

registry

The Windows Registry is a database that stores Windows application data and low-level Windows settings like driver, security, service, system and user information. The registry osquery table expresses the data in the Windows Registry.

Column	Type	Description
data	text	Data content of registry value
key	text	Name of the key to search for
mtime	bigint	timestamp of the most recent registry write
name	text	Name of the registry value entry
path	text	Full path to the value
type	text	Type of the registry value, or 'subkey' if item is a subkey

Example

This query returns the date a Windows Host was enrolled in Fleet:

SELECT strftime('%Y-%m-%d %H:%M:%S', mtime, 'unixepoch') AS enroll_time FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\%%\DeviceEnroller';

This query returns the state of the configurable profiles (i.e., domain, public, standard) in the Windows firewall settings (a value of 1 means the firewall is enabled for the profile):

WITH profiles AS (
SELECT SPLIT(KEY, '\', 7) AS enabled,name,data,'profile' AS grpkey
FROM registry r
WHERE r.path IN (
'\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall', 
'\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall',
'\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall'
    )
),
firewall AS (
SELECT
    MAX(CASE WHEN enabled='DomainProfile' THEN DATA END) AS domain_enabled,
    MAX(CASE WHEN enabled='PublicProfile' THEN DATA END) AS public_enabled,
    MAX(CASE WHEN enabled='StandardProfile' THEN DATA END) AS standard_enabled
FROM profiles
GROUP BY grpkey
)
SELECT *
FROM firewall;

Notes

The registry table is ideal for use in Fleet policies and queries because of the critical operating system and application data stored in the Windows Registry.

Links:

Edit page