Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
startup_items
Applications and binaries set as user/login startup items.
Column | Type | Description |
---|---|---|
args | text | Arguments provided to startup executable |
name | text | Name of startup item |
path | text | Path of startup item |
source | text | Directory or plist containing startup item |
status | text | Startup status; either enabled or disabled |
type | text | Startup Item or Login Item |
username | text | The user associated with the startup item |
List commands executed as user/logon startup items.
SELECT name, type FROM startup_items WHERE status='enabled';