Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Infrastructure as code
See every change, undo any error, repeat every success.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Pricing
More
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Infrastructure as code
See every change, undo any error, repeat every success.
Extend Fleet
Integrate your favorite tools with Fleet.
Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
startup_items
startup_items
Applications and binaries set as startup items.
| Column | Type | Description |
|---|---|---|
| args | text | Arguments provided to startup executable |
| name | text | Name of startup item |
| path | text | Path of startup item |
| source | text | Directory containing startup item (on macOS, the subsystem providing it) |
| status | text | Startup status. On Linux: enabled or disabled. On macOS: Combination of enabled, allowed, notified, and hidden. Apple does not seem to document these status values, but allowed seems to indicate whether it is enabled in System Settings. |
| type | text | Type of startup item. On macOS this can be app, agent (LaunchAgent), daemon (LaunchDaemon), login item, or user item. |
| username | text | The user associated with the startup item |
Example
List commands executed as user/logon startup items.
SELECT name, type FROM startup_items WHERE status='enabled';Questions?
SOC2 Type 2
