Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

sofa_security_release_info

The information on the security release the device is running from SOFA.

Column	Type	Description
days_since_previous_release	integer	The number of days since the previous (older) release
os_version	text	If not specified, this is the version of the operating system that the device is running
product_version	text	The version corresponding to this security release, like "14.4.1"
release_date	text	The date the release was made available
security_info	text	The URL to the information for this release
unique_cves_count	integer	The number of unique CVEs addressed in this release
update_name	text	The name of the release, like "macOS Sonoma 14.4.1"

For historical data, use the os_version predicate

SELECT * FROM sofa_security_release_info WHERE os_version="14.4.0"

By default this table will return vulnerability data for the running operating system.
Use the url constraint (in the WHERE clause) to specify a data source other than the SOFA feed.

Edit page