Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

safari_extensions

Safari extensions add functionality to Safari.app, the native web browser in macOS. The safari_extensions table collects all Safari extensions installed on a Mac.

Column	Type	Description
bundle_version	text	The version of the build that identifies an iteration of the bundle
copyright	text	A human-readable copyright notice for the bundle
description	text	Optional extension description text
identifier	text	Extension identifier
name	text	Extension display name
path	text	Path to the Info.plist describing the extension
sdk	text	Bundle SDK used to compile extension
uid	bigint	The local user that owns the extension
version	text	Extension long version

Example

Collect Safari extensions for all Mac users:

SELECT * FROM users CROSS JOIN safari_extensions USING (uid);

Notes

Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires giving osquery full disk access and a JOIN against the users table.

Query explanation:

The safari_extensions table has a row for each installed extension
Each row has a column with the uid of the user who installed the extension
Each uid from the safari_extensions table is matched in the users table to collect Safari extensions in the output data for all user accounts on the Mac by the JOIN

Links: