Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
appcompat_shims arp_cache authenticode autoexec azure_instance_metadata azure_instance_tags background_activities_moderator battery bitlocker_info carbon_black_info carves certificates chassis_info chocolatey_packages chrome_extension_content_scripts chrome_extensions cis_audit connectivity cpu_info cpuid cryptoinfo curl curl_certificate default_environment disk_info dns_cache drivers ec2_instance_metadata ec2_instance_tags etc_hosts etc_protocols etc_services file file_lines firefox_addons firefox_preferences fleetd_logs google_chrome_profiles groups hash hvci_status ie_extensions intel_me_info interface_addresses interface_details kernel_info kva_speculative_info listening_ports logged_in_users logical_drives logon_sessions mdm_bridge memory_devices npm_packages ntdomains ntfs_acl_permissions ntfs_journal_events 
office_mru orbit_info os_version osquery_events osquery_extensions osquery_flags osquery_info osquery_packs osquery_registry osquery_schedule parse_ini parse_json parse_jsonl parse_xml patches physical_disk_performance pipes platform_info powershell_events prefetch process_etw_events process_memory_map process_open_sockets processes programs puppet_info puppet_logs puppet_state python_packages registry routes scheduled_tasks secureboot security_profile_info services shared_resources shellbags shimcache sntp_request ssh_configs startup_items system_info time tpm_info uptime user_groups user_ssh_keys userassist users video_info vscode_extensions winbaseobj windows_crashes windows_eventlog windows_events windows_firewall_rules windows_optional_features windows_search windows_security_center windows_security_products windows_update_history windows_updates wmi_bios_info wmi_cli_event_consumers wmi_event_filters wmi_filter_consumer_binding wmi_script_event_consumers yara ycloud_instance_metadata
office_mru orbit_info os_version osquery_events osquery_extensions osquery_flags osquery_info osquery_packs osquery_registry osquery_schedule parse_ini parse_json parse_jsonl parse_xml patches physical_disk_performance pipes platform_info powershell_events prefetch process_etw_events process_memory_map process_open_sockets processes programs puppet_info puppet_logs puppet_state python_packages registry routes scheduled_tasks secureboot security_profile_info services shared_resources shellbags shimcache sntp_request ssh_configs startup_items system_info time tpm_info uptime user_groups user_ssh_keys userassist users video_info vscode_extensions winbaseobj windows_crashes windows_eventlog windows_events windows_firewall_rules windows_optional_features windows_search windows_security_center windows_security_products windows_update_history windows_updates wmi_bios_info wmi_cli_event_consumers wmi_event_filters wmi_filter_consumer_binding wmi_script_event_consumers yara ycloud_instance_metadata video_info
video_info
Retrieve video card information of the machine.
| Column | Type | Description |
|---|---|---|
| color_depth | integer | The amount of bits per pixel to represent color. |
| driver | text | The driver of the device. |
| driver_date | bigint | The date listed on the installed driver. |
| driver_version | text | The version of the installed driver. |
| manufacturer | text | The manufacturer of the gpu. |
| model | text | The model of the gpu. |
| series | text | The series of the gpu. |
| video_mode | text | The current resolution of the display. |
Edit page
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
