Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
signature
signature
File (executable, bundle, installer, disk) code signing status.
| Column | Type | Description |
|---|---|---|
| arch | text | If applicable, the arch of the signed code |
| authority | text | Certificate Common Name |
| cdhash | text | Hash of the application Code Directory |
| hash_executable | integer | Set to 1 to also hash the executable, or 0 otherwise. Default is 1 |
| hash_resources | integer | Set to 1 to also hash resources, or 0 otherwise. Default is 1 |
| identifier | text | The signing identifier sealed into the signature |
| path | text | Must provide a path or directory Required in WHERE clause |
| signed | integer | 1 If the file is signed else 0 |
| team_identifier | text | The team signing identifier sealed into the signature |
Example
Identify system extensions that are not managed via MDM and see their signature status.
SELECT se.identifier, se.bundle_path, se.category, se.state, s.signed FROM system_extensions se JOIN signature s on s.path = se.bundle_path WHERE se.mdm_managed='0';
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
