Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

tcc_access

Information about macOS TCC database contents, for determining permissions granted to applications.

Column	Type	Description
auth_reason	integer	TODO
auth_value	integer	Indicates whether the access is: denied (0), unknown (1), allowed (2), or limited (3).
client	text	The bundle identifier or absolute path to the program using the TCC service.
client_type	integer	Indicates whether client is a bundle identifier (0) or absolute path (1).
indirect_object_identifier	text	For kTCCServiceAppleEvents, what the client is asking to interact with, or "UNUSED" when it doesn't apply. Absolute path or bundle identifier.
indirect_object_identifier_type	integer	Indicates whether indirect_object_identifier is a bundle identifier (0) or absolute path (1), if applicable.
last_modified	bigint	The last time the entry was modified, in epoch seconds.
policy_id	integer	The MDM policy that allows TCC access for the application.
service	text	The name of the TCC service.
source	text	Either "user" or "system".
uid	integer	The local user the permissions are for. `0` for the system (root) user.

This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).
This table requires that Fleet's agent (fleetd) has Full Disk Access.

Edit page