Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
appcompat_shims arp_cache authenticode autoexec azure_instance_metadata azure_instance_tags background_activities_moderator battery bitlocker_info carbon_black_info carves certificates chassis_info chocolatey_packages chrome_extension_content_scripts chrome_extensions cis_audit connectivity cpu_info cpuid cryptoinfo curl curl_certificate default_environment disk_info dns_cache drivers ec2_instance_metadata ec2_instance_tags etc_hosts etc_protocols etc_services file file_lines firefox_addons firefox_preferences fleetd_logs google_chrome_profiles groups hash hvci_status ie_extensions intel_me_info interface_addresses interface_details kernel_info kva_speculative_info listening_ports logged_in_users logical_drives logon_sessions mdm_bridge memory_devices npm_packages ntdomains ntfs_acl_permissions ntfs_journal_events 
office_mru orbit_info os_version osquery_events osquery_extensions osquery_flags osquery_info osquery_packs osquery_registry osquery_schedule parse_ini parse_json parse_jsonl parse_xml patches physical_disk_performance pipes platform_info powershell_events prefetch process_etw_events process_memory_map process_open_sockets processes programs puppet_info puppet_logs puppet_state python_packages registry routes scheduled_tasks secureboot security_profile_info services shared_resources shellbags shimcache sntp_request ssh_configs startup_items system_info time tpm_info uptime user_groups user_ssh_keys userassist users video_info vscode_extensions winbaseobj windows_crashes windows_eventlog windows_events windows_firewall_rules windows_optional_features windows_search windows_security_center windows_security_products windows_update_history windows_updates wmi_bios_info wmi_cli_event_consumers wmi_event_filters wmi_filter_consumer_binding wmi_script_event_consumers yara ycloud_instance_metadata
office_mru orbit_info os_version osquery_events osquery_extensions osquery_flags osquery_info osquery_packs osquery_registry osquery_schedule parse_ini parse_json parse_jsonl parse_xml patches physical_disk_performance pipes platform_info powershell_events prefetch process_etw_events process_memory_map process_open_sockets processes programs puppet_info puppet_logs puppet_state python_packages registry routes scheduled_tasks secureboot security_profile_info services shared_resources shellbags shimcache sntp_request ssh_configs startup_items system_info time tpm_info uptime user_groups user_ssh_keys userassist users video_info vscode_extensions winbaseobj windows_crashes windows_eventlog windows_events windows_firewall_rules windows_optional_features windows_search windows_security_center windows_security_products windows_update_history windows_updates wmi_bios_info wmi_cli_event_consumers wmi_event_filters wmi_filter_consumer_binding wmi_script_event_consumers yara ycloud_instance_metadata windows_updates
windows_updates
Returns information about Windows updates that are available for installation.
| Column | Type | Description |
|---|---|---|
| fullkey | text | The expanded name of the specific item that describes the update. |
| is_default | text | Whether or not the update is the default. |
| key | text | A specific item that describes the update. |
| locale | text | Location of the update. |
| parent | text | The key's parent. |
| query | text | The query is printed in this column. |
| value | text | The value for the specified key. |
Notes
- This table may not return any results while updates are being downloaded and installed.
- This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by Kolide.
Edit page
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
