Vitals

Fleet’s built-in queries for collecting and storing important device information.

Apple

Linux

Windows Windows

ChromeOS

Battery Disk encryption Disk space Google Chrome profiles MDM MDM configuration profiles MDM Disk encryption key file MDM Disk encryption key file lines Munki info Network interfaces Orbit information Operating system information Osquery flags Osquery information Scheduled osquery statistics Software Software codesign Software Firefox VScode extensions Uptime Users

Disk encryption Disk space Google Chrome profiles Network interfaces Orbit information Operating system information Osquery flags Osquery information Scheduled osquery statistics Software VScode extensions Uptime Users

Battery Disk encryption Disk space Google Chrome profiles MDM Network interfaces Orbit information Operating system information Operating system version Osquery flags Osquery information Scheduled osquery statistics VScode extensions Software System information Uptime Users Windows update history

ChromeOS profile user info Google Chrome profiles Network interfaces Operating system information Software Users

Software Firefox

A software override query to differentiate between Firefox and Firefox ESR on macOS. Requires fleetd

Query PowerShellNEW BashNEW

WITH app_paths AS (
        SELECT path
        FROM apps
        WHERE bundle_identifier = 'org.mozilla.firefox'
      ),
      remoting_name AS (
        SELECT value, path
        FROM parse_ini
        WHERE key = 'RemotingName'
        AND path IN (SELECT CONCAT(path, '/Contents/Resources/application.ini') FROM app_paths)
      )
      SELECT
        CASE
          WHEN remoting_name.value = 'firefox-esr' THEN 'Firefox ESR.app'
          ELSE 'Firefox.app'
        END AS name,
        COALESCE(NULLIF(apps.bundle_short_version, ''), apps.bundle_version) AS version,
        apps.bundle_identifier AS bundle_identifier,
        '' AS extension_id,
        '' AS browser,
        'apps' AS source,
        '' AS vendor,
        apps.last_opened_time AS last_opened_at,
        apps.path AS installed_path
      FROM apps
      LEFT JOIN remoting_name ON apps.path = REPLACE(remoting_name.path, '/Contents/Resources/application.ini', '')
      WHERE apps.bundle_identifier = 'org.mozilla.firefox'

PowerShell commands are currently work in progress, contributions welcome.

Bash commands are currently work in progress, contributions welcome.

This query uses the parse_ini data table. Learn more

Suggest an edit