Vitals

Fleet’s built-in queries for collecting and storing important device information.

Apple

Linux

Windows

ChromeOS

Battery Disk encryption Disk space Google Chrome profiles Host certificates MDM MDM configuration profiles MDM Disk encryption key file MDM Disk encryption key file lines Munki info Network interfaces Orbit information Operating system information Osquery flags Osquery information Scheduled osquery statistics Software Software codesign Software Firefox Software Python packages Software Python packages including user directory VScode extensions Uptime Users

Disk encryption Disk space Google Chrome profiles Network interfaces Orbit information Operating system information Osquery flags Osquery information Scheduled osquery statistics Software Software Python packages Software Python packages including user directory VScode extensions Uptime Users

Battery Disk encryption Disk space Google Chrome profiles MDM Network interfaces Orbit information Operating system information Operating system version Osquery flags Osquery information Scheduled osquery statistics Software Python packages Software Python packages including user directory VScode extensions Software System information Uptime Users Windows update history

ChromeOS profile user info Google Chrome profiles Network interfaces Operating system information Software Users

Software Firefox

A software override query to differentiate between Firefox and Firefox ESR on macOS. Requires fleetd

Query PowerShellNEW BashNEW

WITH app_paths AS (
        SELECT path
        FROM apps
        WHERE bundle_identifier = 'org.mozilla.firefox'
      ),
      remoting_name AS (
        SELECT value, path
        FROM parse_ini
        WHERE key = 'RemotingName'
        AND path IN (SELECT CONCAT(path, '/Contents/Resources/application.ini') FROM app_paths)
      )
      SELECT
        CASE
          WHEN remoting_name.value = 'firefox-esr' THEN 'Firefox ESR.app'
          ELSE 'Firefox.app'
        END AS name,
        COALESCE(NULLIF(apps.bundle_short_version, ''), apps.bundle_version) AS version,
        apps.bundle_identifier AS bundle_identifier,
        '' AS extension_id,
        '' AS browser,
        'apps' AS source,
        '' AS vendor,
        apps.last_opened_time AS last_opened_at,
        apps.path AS installed_path
      FROM apps
      LEFT JOIN remoting_name ON apps.path = REPLACE(remoting_name.path, '/Contents/Resources/application.ini', '')
      WHERE apps.bundle_identifier = 'org.mozilla.firefox'