Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Stripe + Fleet
Stripe consolidates multiple tools with Fleet.
Foursquare + Fleet
Foursquare quickly migrates to Fleet for device management.
What people are saying
Stories from the Fleet community.
Pricing
More
Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
santa_allowed
santa_allowed
Logs events for when Santa allowed applications to run on the host. Fleet's agent (fleetd) only stores the most recent 10,000 allowed events.
| Column | Type | Description |
|---|---|---|
| application | text | Path to the application |
| reason | text | Reason for the decision |
| sha256 | text | SHA256 hash of the binary |
| timestamp | text | Timestamp of the decision |
Example
Show Google Chrome open events, as allowed by Santa.
SELECT * FROM santa_allowed WHERE application = '/Applications/Google Chrome.app';Notes
- Fleetd only stores the most recent 10,000 allowed events to avoid hitting osquery watchdog limits.
- If you're running this query as a scheduled query, use the
differential_ignore_removalsto avoid hitting osquery watchdog limits
Questions?
SOC2 Type 2
