Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
user_events
user_events EVENTED TABLE
Track user events from the audit framework.
| Column | Type | Description |
|---|---|---|
| address | text | The Internet protocol address or family ID |
| auid | bigint | Audit User ID |
| eid | text | Event ID Not returned in SELECT * FROM user_events. |
| message | text | Message from the event |
| path | text | Supplied path from event |
| pid | bigint | Process (or thread) ID |
| terminal | text | The network protocol ID |
| time | bigint | Time of execution in UNIX time |
| type | integer | The file description for the process socket |
| uid | bigint | User ID |
| uptime | bigint | Time of execution in system uptime |
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
