Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

suid_bin

suid binaries in common locations.

Column	Type	Description
groupname	text	Binary owner group
path	text	Binary path
permissions	text	Binary permissions
pid_with_namespace	integer	Pids that contain a namespace Only available on Linux
username	text	Binary owner username

Example

Identify unsigned executables with suid privileges.

SELECT s.path, s.username, s.permissions, sig.signed, sig.team_identifier, sig.authority FROM suid_bin s JOIN signature sig on s.path = sig.path WHERE sig.signed='0';

Edit page