Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

santa_status

The output of santactl status --json showing current Santa statistics and configuration.

Column	Type	Description
binary_rules	integer	Binary rules count
block_usb	integer	Block USB enabled (1=true, 0=false)
bundle_scanning	integer	Whether bundle scanning is enabled (1=true, 0=false)
cdhash_rules	integer	CDHash rules count
certificate_rules	integer	Certificate rules count
clean_required	integer	Whether a clean is required (1=true, 0=false)
compiler_rules	integer	Compiler rules count
driver_connected	integer	Whether the driver is connected (1=true, 0=false)
events_pending_upload	integer	Events pending upload
file_logging	integer	File logging enabled (1=true, 0=false)
last_successful_full	text	Last successful full sync
last_successful_rule	text	Last successful rule sync
log_type	text	Log type (e.g., file)
mode	text	Santa mode (e.g., Monitor)
non_root_cache_count	integer	Non-root cache count
on_start_usb_options	text	USB options on start
push_notifications	text	Push notifications status
remount_usb_mode	text	Remount USB mode
root_cache_count	integer	Root cache count
server	text	Sync server address
signingid_rules	integer	Signing ID rules count
static_rule_count	integer	Static rule count
teamid_rules	integer	Team ID rules count
transitive_rules_count	integer	Transitive rules count
transitive_rules_enabled	integer	Transitive rules enabled (1=true, 0=false)
watch_items_enabled	integer	Watch items enabled (1=true, 0=false)
watchdog_cpu_events	integer	Number of watchdog CPU events
watchdog_cpu_peak	double	Peak CPU usage
watchdog_ram_events	integer	Number of watchdog RAM events
watchdog_ram_peak	double	Peak RAM usage