Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
shell_history
shell_history
A line-delimited (command) table of per-user .*_history data.
| Column | Type | Description |
|---|---|---|
| command | text | Unparsed date/line/command history line |
| history_file | text | Path to the .*_history for this user |
| time | integer | Entry timestamp. It could be absent, default value is 0. |
| uid | bigint | Shell history owner |
Example
SELECT * FROM users CROSS JOIN shell_history USING (uid);See command line executions and related timestamps. Useful for threat hunting when a device is suspected of being compromised.
SELECT u.username, s.command, s.time FROM users u CROSS JOIN shell_history s USING (uid);Notes
- Querying this table requires joining against the
userstable. Learn more
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
