Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
xprotect_reports
xprotect_reports
Database of XProtect matches (if user generated/sent an XProtect report).
| Column | Type | Description |
|---|---|---|
| name | text | Description of XProtected malware |
| time | text | Quarantine alert time |
| user_action | text | Action taken by user after prompted |
Example
See all Xprotect activity reports, if any are present. This indicates potentially malicious software was blocked by Xprotect.
SELECT * FROM xprotect_reports;Notes
- In very specific circumstances this table will return empty because xprotect will detect and remediate without generating an eicar file.
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
