4
osquery | Schema
source link: https://osquery.io/schema/5.0.1/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
osquery | SchemaCOLUMNTYPEDESCRIPTIONuidbigintUser IDcreation_timedoubleWhen the account was first createdfailed_login_countbigintThe number of failed login attempts using an incorrect password. Count resets after a correct password is entered.failed_login_timestampdoubleThe time of the last failed login attempt. Resets after a correct password is enteredpassword_last_set_timedoubleThe time the password was last changedCOLUMNTYPEDESCRIPTIONnametextACPI table namesizeintegerSize of compiled table datamd5textMD5 hash of table contentCOLUMNTYPEDESCRIPTIONnametextThe OS X-specific configuration namedomaintextActive Directory trust domainoptiontextCanonical name of optionvaluetextVariable typed option valueCOLUMNTYPEDESCRIPTIONallow_signed_enabledinteger1 If allow signed mode is enabled else 0firewall_unloadinteger1 If firewall unloading enabled else 0global_stateinteger1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0logging_enabledinteger1 If logging mode is enabled else 0logging_optionintegerFirewall logging optionstealth_enabledinteger1 If stealth mode is enabled else 0versiontextApplication Layer Firewall versionCOLUMNTYPEDESCRIPTIONpathtextPath to the executable that is exceptedstateintegerFirewall exception stateCOLUMNTYPEDESCRIPTIONprocesstextProcess name explicitly allowedCOLUMNTYPEDESCRIPTIONschemetextName of the scheme/protocolhandlertextApplication label for the handlerenabledinteger1 if this handler is the OS default, else 0externalinteger1 if this handler does NOT exist on OS X by default, else 0protectedinteger1 if this handler is protected (reserved) by OS X, else 0COLUMNTYPEDESCRIPTIONtypetextEvent typemessagetextRaw audit messagetimebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeeidtextEvent IDapparmortextApparmor Status like ALLOWED, DENIED etc.operationtextPermission requested by the processparentunsigned_bigintParent process PIDprofiletextApparmor profile namenametextProcess namepidunsigned_bigintProcess IDcommtextCommand-line name of the command that was used to invoke the analyzed processdenied_masktextDenied permissions for the processcapnametextCapability requested by the processfsuidunsigned_bigintFilesystem user IDouidunsigned_bigintObject owner's user IDcapabilitybigintCapability numberrequested_masktextRequested access maskinfotextAdditional informationerrortextError informationnamespacetextAppArmor namespacelabeltextAppArmor labelCOLUMNTYPEDESCRIPTIONpathtextUnique, aa-status compatible, policy identifier.nametextPolicy name.attachtextWhich executable(s) a profile will attach to.modetextHow the policy is applied.sha1textA unique hash that identifies this policy.COLUMNTYPEDESCRIPTIONexecutabletextName of the executable that is being shimmed. This is pulled from the registry.pathtextThis is the path to the SDB database.descriptiontextDescription of the SDB.install_timeintegerInstall time of the SDBtypetextType of the SDB database.sdb_idtextUnique GUID of the SDB.COLUMNTYPEDESCRIPTIONnametextName of the Name.app folderpathtextAbsolute and full Name.app pathbundle_executabletextInfo properties CFBundleExecutable labelbundle_identifiertextInfo properties CFBundleIdentifier labelbundle_nametextInfo properties CFBundleName labelbundle_short_versiontextInfo properties CFBundleShortVersionString labelbundle_versiontextInfo properties CFBundleVersion labelbundle_package_typetextInfo properties CFBundlePackageType labelenvironmenttextApplication-set environment variableselementtextDoes the app identify as a background agentcompilertextInfo properties DTCompiler labeldevelopment_regiontextInfo properties CFBundleDevelopmentRegion labeldisplay_nametextInfo properties CFBundleDisplayName labelinfo_stringtextInfo properties CFBundleGetInfoString labelminimum_system_versiontextMinimum version of OS X required for the app to runcategorytextThe UTI that categorizes the app for the App Storeapplescript_enabledtextInfo properties NSAppleScriptEnabled labelcopyrighttextInfo properties NSHumanReadableCopyright labellast_opened_timedoubleThe time that the app was last usedCOLUMNTYPEDESCRIPTIONnametextRepository namesourcetextSource filebase_uritextRepository base URIreleasetextRelease nameversiontextRepository source versionmaintainertextRepository maintainercomponentstextRepository componentsarchitecturestextRepository architecturespid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONaddresstextIPv4 address targetmactextMAC address of broadcasted addressinterfacetextInterface of the network for the MACpermanenttext1 for true, 0 for falseCOLUMNTYPEDESCRIPTIONtimeintegerUnix timestamp. Set automaticallytime_nano_secintegerNanosecond time.hosttextSender's address (set by the server).sendertextSender's identification string. Default is process name.facilitytextSender's facility. Default is 'user'.pidintegerSending process ID encoded as a string. Set automatically.gidbigintGID that sent the log message (set by the server).uidbigintUID that sent the log message (set by the server).levelintegerLog level number. See levels in asl.h.messagetextMessage text.ref_pidintegerReference PID for messages proxied by launchdref_proctextReference process for messages proxied by launchdextratextExtra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.COLUMNTYPEDESCRIPTIONnametextPackage display nameversiontextPackage supplied versiondescriptiontextPackage supplied descriptionpathtextPackage's package.json pathlicensetextLicense for packagehomepagetextPackage supplied homepageuidbigintThe local user that owns the pluginCOLUMNTYPEDESCRIPTIONnodetextThe node path of the configuration itemvaluetextThe value of the configuration itemlabeltextThe label of the configuration itempathtextThe path to the configuration fileCOLUMNTYPEDESCRIPTIONpathtextMust provide a path or directoryoriginal_program_nametextThe original program name that the publisher has signedserial_numbertextThe certificate serial numberissuer_nametextThe certificate issuer namesubject_nametextThe certificate subject nameresulttextThe signature check resultCOLUMNTYPEDESCRIPTIONlabeltextLabel of the authorization rightplugintextAuthorization plugin namemechanismtextName of the mechanism that will be calledprivilegedtextIf privileged it will run as root, else as an anonymous userentrytextThe whole string entryCOLUMNTYPEDESCRIPTIONlabeltextItem name, usually in reverse domain formatmodifiedtextLabel top-level keyallow_roottextLabel top-level keytimeouttextLabel top-level keyversiontextLabel top-level keytriestextLabel top-level keyauthenticate_usertextLabel top-level keysharedtextLabel top-level keycommenttextLabel top-level keycreatedtextLabel top-level keyclasstextLabel top-level keysession_ownertextLabel top-level keyCOLUMNTYPEDESCRIPTIONuidbigintThe local owner of authorized_keys filealgorithmtextalgorithm of keykeytextparsed authorized keys linekey_filetextPath to the authorized_keys filepid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONpathtextPath to the executablenametextName of the programsourcetextSource table of the autoexec itemCOLUMNTYPEDESCRIPTIONlocationtextAzure Region the VM is running innametextName of the VMoffertextOffer information for the VM image (Azure image gallery VMs only)publishertextPublisher of the VM imageskutextSKU for the VM imageversiontextVersion of the VM imageos_typetextLinux or Windowsplatform_update_domaintextUpdate domain the VM is running inplatform_fault_domaintextFault domain the VM is running invm_idtextUnique identifier for the VMvm_sizetextVM sizesubscription_idtextAzure subscription for the VMresource_group_nametextResource group for the VMplacement_group_idtextPlacement group for the VM scale setvm_scale_set_nametextVM scale set namezonetextAvailability zone of the VMCOLUMNTYPEDESCRIPTIONvm_idtextUnique identifier for the VMkeytextThe tag keyvaluetextThe tag valueCOLUMNTYPEDESCRIPTIONpathtextApplication file path.last_execution_timebigintMost recent time application was executed.sidtextUser SID.COLUMNTYPEDESCRIPTIONmanufacturertextThe battery manufacturer's namemanufacture_dateintegerThe date the battery was manufactured UNIX EpochmodeltextThe battery's model numberserial_numbertextThe battery's unique serial numbercycle_countintegerThe number of charge/discharge cycleshealthtextOne of the following: "Good" describes a well-performing battery, "Fair" describes a functional battery with limited capacity, or "Poor" describes a battery that's not capable of providing powerconditiontextOne of the following: "Normal" indicates the condition of the battery is within normal tolerances, "Service Needed" indicates that the battery should be checked out by a licensed Mac repair service, "Permanent Failure" indicates the battery needs replacementstatetextOne of the following: "AC Power" indicates the battery is connected to an external power source, "Battery Power" indicates that the battery is drawing internal power, "Off Line" indicates the battery is off-line or no longer connectedcharginginteger1 if the battery is currently being charged by a power source. 0 otherwisechargedinteger1 if the battery is currently completely charged. 0 otherwisedesigned_capacityintegerThe battery's designed capacity in mAhmax_capacityintegerThe battery's actual capacity when it is fully charged in mAhcurrent_capacityintegerThe battery's current charged capacity in mAhpercent_remainingintegerThe percentage of battery remaining before it is drainedamperageintegerThe battery's current amperage in mAvoltageintegerThe battery's current voltage in mVminutes_until_emptyintegerThe number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculatedminutes_to_full_chargeintegerThe number of minutes until the battery is fully charged. This value is -1 if this time is still being calculatedCOLUMNTYPEDESCRIPTIONdevice_idtextID of the encrypted drive.drive_lettertextDrive letter of the encrypted drive.persistent_volume_idtextPersistent ID of the drive.conversion_statusintegerThe bitlocker conversion status of the drive.protection_statusintegerThe bitlocker protection status of the drive.encryption_methodtextThe encryption type of the device.versionintegerThe FVE metadata version of the drive.percentage_encryptedintegerThe percentage of the drive that is encrypted.lock_statusintegerThe accessibility status of the drive from Windows.COLUMNTYPEDESCRIPTIONnametextBlock device nameparenttextBlock device parent namevendortextBlock device vendor stringmodeltextBlock device model string identifiersizebigintBlock device size in blocksblock_sizeintegerBlock size in bytesuuidtextBlock device Universally Unique IdentifiertypetextBlock device type stringlabeltextBlock device label stringCOLUMNTYPEDESCRIPTIONtidbigintThread IDpidbigintProcess IDparentbigintParent process IDuidbigintUser IDgidbigintGroup IDcidintegerCgroup IDexit_codetextExit code of the system callprobe_errorintegerSet to 1 if one or more buffers could not be capturedsyscalltextSystem call namepathtextBinary pathcwdtextCurrent working directorycmdlinetextCommand line argumentsdurationintegerHow much time was spent inside the syscall (nsecs)json_cmdlinetextCommand line arguments, in JSON formatntimetextThe nsecs uptime timestamp as obtained from BPFtimebigintTime of execution in UNIX timeeidintegerEvent IDCOLUMNTYPEDESCRIPTIONtidbigintThread IDpidbigintProcess IDparentbigintParent process IDuidbigintUser IDgidbigintGroup IDcidintegerCgroup IDexit_codetextExit code of the system callprobe_errorintegerSet to 1 if one or more buffers could not be capturedsyscalltextSystem call namepathtextPath of executed filefdtextThe file description for the process socketfamilyintegerThe Internet protocol family IDtypeintegerThe socket typeprotocolintegerThe network protocol IDlocal_addresstextLocal address associated with socketremote_addresstextRemote address associated with socketlocal_portintegerLocal network protocol port numberremote_portintegerRemote network protocol port numberdurationintegerHow much time was spent inside the syscall (nsecs)ntimetextThe nsecs uptime timestamp as obtained from BPFtimebigintTime of execution in UNIX timeeidintegerEvent IDCOLUMNTYPEDESCRIPTIONuidbigintThe local user that owns the pluginnametextPlugin display nameidentifiertextPlugin identifierversiontextPlugin short versionsdktextBuild SDK used to compile plugindescriptiontextPlugin description textdevelopment_regiontextPlugin language-localizationnativeintegerPlugin requires native executionpathtextPath to plugin bundledisabledintegerIs the plugin disabled. 1 = DisabledCOLUMNTYPEDESCRIPTIONsensor_idintegerSensor ID of the Carbon Black sensorconfig_nametextSensor groupcollect_store_filesintegerIf the sensor is configured to send back binaries to the Carbon Black servercollect_module_loadsintegerIf the sensor is configured to capture module loadscollect_module_infointegerIf the sensor is configured to collect metadata of binariescollect_file_modsintegerIf the sensor is configured to collect file modification eventscollect_reg_modsintegerIf the sensor is configured to collect registry modification eventscollect_net_connsintegerIf the sensor is configured to collect network connectionscollect_processesintegerIf the sensor is configured to process eventscollect_cross_processesintegerIf the sensor is configured to cross process eventscollect_emet_eventsintegerIf the sensor is configured to EMET eventscollect_data_file_writesintegerIf the sensor is configured to collect non binary file writescollect_process_user_contextintegerIf the sensor is configured to collect the user running a processcollect_sensor_operationsintegerUnknownlog_file_disk_quota_mbintegerEvent file disk quota in MBlog_file_disk_quota_percentageintegerEvent file disk quota in a percentageprotection_disabledintegerIf the sensor is configured to report tamper eventssensor_ip_addrtextIP address of the sensorsensor_backend_servertextCarbon Black serverevent_queueintegerSize in bytes of Carbon Black event files on diskbinary_queueintegerSize in bytes of binaries waiting to be sent to Carbon Black serverCOLUMNTYPEDESCRIPTIONtimebigintTime at which the carve was kicked offsha256textA SHA256 sum of the carved archivesizeintegerSize of the carved archivepathtextThe path of the requested carvestatustextStatus of the carve, can be STARTING, PENDING, SUCCESS, or FAILEDcarve_guidtextIdentifying value of the carve sessionrequest_idtextIdentifying value of the carve request (e.g., scheduled query name, distributed request, etc)carveintegerSet this value to '1' to start a file carveCOLUMNTYPEDESCRIPTIONcommon_nametextCertificate CommonNamesubjecttextCertificate distinguished nameissuertextCertificate issuer distinguished namecainteger1 if CA: true (certificate is an authority) else 0self_signedinteger1 if self-signed, else 0not_valid_beforetextLower bound of valid datenot_valid_aftertextCertificate expiration datasigning_algorithmtextSigning algorithm usedkey_algorithmtextKey algorithm usedkey_strengthtextKey size used for RSA/DSA, or curve namekey_usagetextCertificate key usage and extended key usagesubject_key_idtextSKID an optionally included SHA1authority_key_idtextAKID an optionally included SHA1sha1textSHA1 hash of the raw certificate contentspathtextPath to Keychain or PEM bundleserialtextCertificate serial numbersidtextSIDstore_locationtextCertificate system store locationstoretextCertificate system storeusernametextUsernamestore_idtextExists for service/user stores. Contains raw store id provided by WinAPI.COLUMNTYPEDESCRIPTIONaudible_alarmtextIf TRUE, the frame is equipped with an audible alarm.breach_descriptiontextIf provided, gives a more detailed description of a detected security breach.chassis_typestextA comma-separated list of chassis types, such as Desktop or Laptop.descriptiontextAn extended description of the chassis if available.locktextIf TRUE, the frame is equipped with a lock.manufacturertextThe manufacturer of the chassis.modeltextThe model of the chassis.security_breachtextThe physical status of the chassis such as Breach Successful, Breach Attempted, etc.serialtextThe serial number of the chassis.smbios_tagtextThe assigned asset tag number of the chassis.skutextThe Stock Keeping Unit number if available.statustextIf available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail.visible_alarmtextIf TRUE, the frame is equipped with a visual alarm.COLUMNTYPEDESCRIPTIONnametextPackage display nameversiontextPackage-supplied versionsummarytextPackage-supplied summaryauthortextOptional package authorlicensetextLicense under which package is launchedpathtextPath at which this package residesCOLUMNTYPEDESCRIPTIONbrowser_typetextThe browser type (Valid values: chrome, chromium, opera, yandex, brave)uidbigintThe local user that owns the extensionidentifiertextExtension identifierversiontextExtension-supplied versionscripttextThe content script used by the extensionmatchtextThe pattern that the script is matched againstprofile_pathtextThe profile pathpathtextPath to extension folderreferencedbigint1 if this extension is referenced by the Preferences file of the profileCOLUMNTYPEDESCRIPTIONbrowser_typetextThe browser type (Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta)uidbigintThe local user that owns the extensionnametextExtension display nameprofiletextThe name of the Chrome profile that contains this extensionprofile_pathtextThe profile pathreferenced_identifiertextExtension identifier, as specified by the preferences file. Empty if the extension is not in the profile.identifiertextExtension identifier, computed from its manifest. Empty in case of error.versiontextExtension-supplied versiondescriptiontextExtension-optional descriptiondefault_localetextDefault locale supported by extensioncurrent_localetextCurrent locale supported by extensionupdate_urltextExtension-supplied update URIauthortextOptional extension authorpersistentinteger1 If extension is persistent across all tabs else 0pathtextPath to extension folderpermissionstextThe permissions required by the extensionpermissions_jsontextThe JSON-encoded permissions required by the extensionoptional_permissionstextThe permissions optionally required by the extensionsoptional_permissions_jsontextThe JSON-encoded permissions optionally required by the extensionsmanifest_hashtextThe SHA256 hash of the manifest.json filereferencedbigint1 if this extension is referenced by the Preferences file of the profilefrom_webstoretextTrue if this extension was installed from the web storestatetext1 if this extension is enabledinstall_timetextExtension install time, in its original Webkit formatinstall_timestampbigintExtension install time, converted to unix timemanifest_jsontextThe manifest file of the extensionkeytextThe extension key, from the manifest fileCOLUMNTYPEDESCRIPTIONdisconnectedintegerTrue if the all interfaces are not connected to any networkipv4_no_trafficintegerTrue if any interface is connected via IPv4, but has seen no trafficipv6_no_trafficintegerTrue if any interface is connected via IPv6, but has seen no trafficipv4_subnetintegerTrue if any interface is connected to the local subnet via IPv4ipv4_local_networkintegerTrue if any interface is connected to a routed network via IPv4ipv4_internetintegerTrue if any interface is connected to the Internet via IPv4ipv6_subnetintegerTrue if any interface is connected to the local subnet via IPv6ipv6_local_networkintegerTrue if any interface is connected to a routed network via IPv6ipv6_internetintegerTrue if any interface is connected to the Internet via IPv6COLUMNTYPEDESCRIPTIONdevice_idtextThe DeviceID of the CPU.modeltextThe model of the CPU.manufacturertextThe manufacturer of the CPU.processor_typetextThe processor type, such as Central, Math, or Video.availabilitytextThe availability and status of the CPU.cpu_statusintegerThe current operating status of the CPU.number_of_corestextThe number of cores of the CPU.logical_processorsintegerThe number of logical processors of the CPU.address_widthtextThe width of the CPU address bus.current_clock_speedintegerThe current frequency of the CPU.max_clock_speedintegerThe maximum possible frequency of the CPU.socket_designationtextThe assigned socket on the board for the given CPU.COLUMNTYPEDESCRIPTIONcoreintegerName of the cpu (core)userbigintTime spent in user modenicebigintTime spent in user mode with low priority (nice)systembigintTime spent in system modeidlebigintTime spent in the idle taskiowaitbigintTime spent waiting for I/O to completeirqbigintTime spent servicing interruptssoftirqbigintTime spent servicing softirqsstealbigintTime spent in other operating systems when running in a virtualized environmentguestbigintTime spent running a virtual CPU for a guest OS under the control of the Linux kernelguest_nicebigintTime spent running a niced guest COLUMNTYPEDESCRIPTIONfeaturetextPresent feature flagsvaluetextBit value or stringoutput_registertextRegister used to for feature valueoutput_bitintegerBit in register value for feature valueinput_eaxtextValue of EAX usedCOLUMNTYPEDESCRIPTIONtypetextType of crash logpidbigintProcess (or thread) ID of the crashed processpathtextPath to the crashed processcrash_pathtextLocation of log fileidentifiertextIdentifier of the crashed processversiontextVersion info of the crashed processparentbigintParent PID of the crashed processresponsibletextProcess responsible for the crashed processuidintegerUser ID of the crashed processdatetimetextDate/Time at which the crash occurredcrashed_threadbigintThread ID which crashedstack_tracetextMost recent frame from the stack traceexception_typetextException type of the crashexception_codestextException codes from the crashexception_notestextException notes from the crashregisterstextThe value of the system registersCOLUMNTYPEDESCRIPTIONeventtextThe job @event name (rare)minutetextThe exact minute for the jobhourtextThe hour of the day for the jobday_of_monthtextThe day of the month for the jobmonthtextThe month of the year for the jobday_of_weektextThe day of the week for the jobcommandtextRaw command stringpathtextFile parsedpid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONnametextName of the printeroption_nametextOption nameoption_valuetextOption valueCOLUMNTYPEDESCRIPTIONtitletextTitle of the printed jobdestinationtextThe printer the job was sent tousertextThe user who printed the jobformattextThe format of the print jobsizeintegerThe size of the print jobcompleted_timeintegerWhen the job completed printingprocessing_timeintegerHow long the job took to processcreation_timeintegerWhen the print request was initiatedCOLUMNTYPEDESCRIPTIONurltextThe url for the requestmethodtextThe HTTP method for the requestuser_agenttextThe user-agent string to use for the requestresponse_codeintegerThe HTTP status code for the responseround_trip_timebigintTime taken to complete the requestbytesbigintNumber of bytes in the responseresulttextThe HTTP response bodyCOLUMNTYPEDESCRIPTIONhostnametextHostname (domain[:port]) to CURLcommon_nametextCommon name of company issued toorganizationtextOrganization issued toorganization_unittextOrganization unit issued toserial_numbertextCertificate serial numberissuer_common_nametextIssuer common nameissuer_organizationtextIssuer organizationissuer_organization_unittextIssuer organization unitvalid_fromtextPeriod of validity start datevalid_totextPeriod of validity end datesha256_fingerprinttextSHA-256 fingerprintsha1_fingerprinttextSHA1 fingerprintversionintegerVersion Numbersignature_algorithmtextSignature AlgorithmsignaturetextSignaturesubject_key_identifiertextSubject Key Identifierauthority_key_identifiertextAuthority Key Identifierkey_usagetextUsage of key in certificateextended_key_usagetextExtended usage of key in certificatepoliciestextCertificate Policiessubject_alternative_namestextSubject Alternative Nameissuer_alternative_namestextIssuer Alternative Nameinfo_accesstextAuthority Information Accesssubject_info_accesstextSubject Information Accesspolicy_mappingstextPolicy Mappingshas_expiredinteger1 if the certificate has expired, 0 otherwisebasic_constrainttextBasic Constraintsname_constraintstextName Constraintspolicy_constraintstextPolicy Constraintsdump_certificateintegerSet this value to '1' to dump certificatetimeoutintegerSet this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)pemtextCertificate PEM formatCOLUMNTYPEDESCRIPTIONnametextPackage nameversiontextPackage versionsourcetextPackage sourcesizebigintPackage size in bytesarchtextPackage architecturerevisiontextPackage revisionstatustextPackage statusmaintainertextPackage maintainersectiontextPackage sectionprioritytextPackage prioritypid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONvariabletextName of the environment variablevaluetextValue of the environment variableexpandinteger1 if the variable needs expanding, 0 otherwiseCOLUMNTYPEDESCRIPTIONdevicetextAbsolute file path to device nodepartitiontextA partition numberpathtextA logical path within the device nodefilenametextName portion of file pathinodebigintFilesystem inode numberuidbigintOwning user IDgidbigintOwning group IDmodetextPermission bitssizebigintSize of file in bytesblock_sizeintegerBlock size of filesystematimebigintLast access timemtimebigintLast modification timectimebigintCreation timehard_linksintegerNumber of hard linkstypetextFile statusCOLUMNTYPEDESCRIPTIONtypetextType of devicedevicetextThe device nameversiontextFirmware versionCOLUMNTYPEDESCRIPTIONdevicetextAbsolute file path to device nodepartitiontextA partition numberinodebigintFilesystem inode numbermd5textMD5 hash of provided inode datasha1textSHA1 hash of provided inode datasha256textSHA256 hash of provided inode dataCOLUMNTYPEDESCRIPTIONdevicetextAbsolute file path to device nodepartitionintegerA partition number or descriptionlabeltexttypetextoffsetbigintblocks_sizebigintByte size of each blockblocksbigintNumber of blocksinodesbigintNumber of meta nodesflagsintegerCOLUMNTYPEDESCRIPTIONnametextDisk nameuuidtextDisk Universally Unique Identifierencryptedinteger1 If encrypted: true (disk is encrypted), else 0typetextDescription of cipher type and mode if availableencryption_statustextDisk encryption status with one of following values: encrypted | not encrypted | undefineduidtextCurrently authenticated user if availableuser_uuidtextUUID of authenticated user if availablefilevault_statustextFileVault status with one of following values: on | off | unknownCOLUMNTYPEDESCRIPTIONactiontextAppear or disappearpathtextPath of the DMG file accessednametextDisk event namedevicetextDisk event BSD nameuuidtextUUID of the volume inside DMG if availablesizebigintSize of partition in bytesejectableinteger1 if ejectable, 0 if notmountableinteger1 if mountable, 0 if notwritableinteger1 if writable, 0 if notcontenttextDisk event contentmedia_nametextDisk event media name stringvendortextDisk event vendor stringfilesystemtextFilesystem if availablechecksumtextUDIF Master checksum if available (CRC32)timebigintTime of appearance/disappearance in UNIX timeeidtextEvent IDCOLUMNTYPEDESCRIPTIONpartitionsintegerNumber of detected partitions on disk.disk_indexintegerPhysical drive number of the disk.typetextThe interface type of the disk.idtextThe unique identifier of the drive on the system.pnp_device_idtextThe unique identifier of the drive on the system.disk_sizebigintSize of the disk.manufacturertextThe manufacturer of the disk.hardware_modeltextHard drive model.nametextThe label of the disk object.serialtextThe serial number of the disk.descriptiontextThe OS's description of the disk.COLUMNTYPEDESCRIPTIONnametextDNS record nametypetextDNS record typeflagsintegerDNS record flagsCOLUMNTYPEDESCRIPTIONidintegerAddress type index or ordertypetextAddress type: sortlist, nameserver, searchaddresstextResolver IP/IPv6 addressnetmasktextAddress (sortlist) netmask lengthoptionsbigintResolver optionspid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONidtextContainer IDpathtextFIle or directory path relative to rootfschange_typetextType of change: C:Modified, A:Added, D:DeletedCOLUMNTYPEDESCRIPTIONidtextContainer IDkeytextLabel keyvaluetextOptional label valueCOLUMNTYPEDESCRIPTIONidtextContainer IDtypetextType of mount (bind, volume)nametextOptional mount namesourcetextSource path on hostdestinationtextDestination path inside containerdrivertextDriver providing the mountmodetextMount options (rw, ro)rwinteger1 if read/write. 0 otherwisepropagationtextMount propagationCOLUMNTYPEDESCRIPTIONidtextContainer IDnametextNetwork namenetwork_idtextNetwork IDendpoint_idtextEndpoint IDgatewaytextGatewayip_addresstextIP addressip_prefix_lenintegerIP subnet prefix lengthipv6_gatewaytextIPv6 gatewayipv6_addresstextIPv6 addressipv6_prefix_lenintegerIPv6 subnet prefix lengthmac_addresstextMAC addressCOLUMNTYPEDESCRIPTIONidtextContainer IDtypetextProtocol (tcp, udp)portintegerPort inside the containerhost_iptextHost IP address on which public port is listeninghost_portintegerHost portCOLUMNTYPEDESCRIPTIONidtextContainer IDpidbigintProcess IDnametextThe process path or shorthand argv[0]cmdlinetextComplete argvstatetextProcess stateuidbigintUser IDgidbigintGroup IDeuidbigintEffective user IDegidbigintEffective group IDsuidbigintSaved user IDsgidbigintSaved group IDwired_sizebigintBytes of unpageable memory used by processresident_sizebigintBytes of private memory used by processtotal_sizebigintTotal virtual memory sizestart_timebigintProcess start in seconds since boot (non-sleeping)parentbigintProcess parent's PIDpgroupbigintProcess groupthreadsintegerNumber of threads used by processniceintegerProcess nice level (-20 to 20, default 0)usertextUser nametimetextCumulative CPU time. [DD-]HH:MM:SS formatcpudoubleCPU utilization as percentagememdoubleMemory utilization as percentageCOLUMNTYPEDESCRIPTIONidtextContainer IDnametextContainer namepidsintegerNumber of processesreadbigintUNIX time when stats were readprereadbigintUNIX time when stats were last readintervalbigintDifference between read and preread in nano-secondsdisk_readbigintTotal disk read bytesdisk_writebigintTotal disk write bytesnum_procsintegerNumber of processorscpu_total_usagebigintTotal CPU usagecpu_kernelmode_usagebigintCPU kernel mode usagecpu_usermode_usagebigintCPU user mode usagesystem_cpu_usagebigintCPU system usageonline_cpusintegerOnline CPUspre_cpu_total_usagebigintLast read total CPU usagepre_cpu_kernelmode_usagebigintLast read CPU kernel mode usagepre_cpu_usermode_usagebigintLast read CPU user mode usagepre_system_cpu_usagebigintLast read CPU system usagepre_online_cpusintegerLast read online CPUsmemory_usagebigintMemory usagememory_max_usagebigintMemory maximum usagememory_limitbigintMemory limitnetwork_rx_bytesbigintTotal network bytes readnetwork_tx_bytesbigintTotal network bytes transmittedCOLUMNTYPEDESCRIPTIONidtextContainer IDnametextContainer nameimagetextDocker image (name) used to launch this containerimage_idtextDocker image IDcommandtextCommand with argumentscreatedbigintTime of creation as UNIX timestatetextContainer state (created, restarting, running, removing, paused, exited, dead)statustextContainer status informationpidbigintIdentifier of the initial processpathtextContainer pathconfig_entrypointtextContainer entrypoint(s)started_attextContainer start time as stringfinished_attextContainer finish time as stringprivilegedintegerIs the container privilegedsecurity_optionstextList of container security optionsenv_variablestextContainer environmental variablesreadonly_rootfsintegerIs the root filesystem mounted as read onlycgroup_namespacetextcgroup namespaceipc_namespacetextIPC namespacemnt_namespacetextMount namespacenet_namespacetextNetwork namespacepid_namespacetextPID namespaceuser_namespacetextUser namespaceuts_namespacetextUTS namespaceCOLUMNTYPEDESCRIPTIONidtextImage IDcreatedbigintTime of creation as UNIX timesizebigintSize of instruction in bytescreated_bytextCreated by instructiontagstextComma-separated list of tagscommenttextInstruction commentCOLUMNTYPEDESCRIPTIONidtextImage IDkeytextLabel keyvaluetextOptional label valueCOLUMNTYPEDESCRIPTIONidtextImage IDlayer_idtextLayer IDlayer_orderintegerLayer Order (1 = base layer)COLUMNTYPEDESCRIPTIONidtextImage IDcreatedbigintTime of creation as UNIX timesize_bytesbigintSize of image in bytestagstextComma-separated list of repository tagsCOLUMNTYPEDESCRIPTIONidtextDocker system IDcontainersintegerTotal number of containerscontainers_runningintegerNumber of containers currently runningcontainers_pausedintegerNumber of containers in paused statecontainers_stoppedintegerNumber of containers in stopped stateimagesintegerNumber of imagesstorage_drivertextStorage drivermemory_limitinteger1 if memory limit support is enabled. 0 otherwiseswap_limitinteger1 if swap limit support is enabled. 0 otherwisekernel_memoryinteger1 if kernel memory limit support is enabled. 0 otherwisecpu_cfs_periodinteger1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwisecpu_cfs_quotainteger1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwisecpu_sharesinteger1 if CPU share weighting support is enabled. 0 otherwisecpu_setinteger1 if CPU set selection support is enabled. 0 otherwiseipv4_forwardinginteger1 if IPv4 forwarding is enabled. 0 otherwisebridge_nf_iptablesinteger1 if bridge netfilter iptables is enabled. 0 otherwisebridge_nf_ip6tablesinteger1 if bridge netfilter ip6tables is enabled. 0 otherwiseoom_kill_disableinteger1 if Out-of-memory kill is disabled. 0 otherwiselogging_drivertextLogging drivercgroup_drivertextControl groups driverkernel_versiontextKernel versionostextOperating systemos_typetextOperating system typearchitecturetextHardware architecturecpusintegerNumber of CPUsmemorybigintTotal memoryhttp_proxytextHTTP proxyhttps_proxytextHTTPS proxyno_proxytextComma-separated list of domain extensions proxy should not be used fornametextName of the docker hostserver_versiontextServer versionroot_dirtextDocker root directoryCOLUMNTYPEDESCRIPTIONidtextNetwork IDkeytextLabel keyvaluetextOptional label valueCOLUMNTYPEDESCRIPTIONidtextNetwork IDnametextNetwork namedrivertextNetwork drivercreatedbigintTime of creation as UNIX timeenable_ipv6integer1 if IPv6 is enabled on this network. 0 otherwisesubnettextNetwork subnetgatewaytextNetwork gatewayCOLUMNTYPEDESCRIPTIONversiontextDocker versionapi_versiontextAPI versionmin_api_versiontextMinimum API version supportedgit_committextDocker build git commitgo_versiontextGo versionostextOperating systemarchtextHardware architecturekernel_versiontextKernel versionbuild_timetextBuild timeCOLUMNTYPEDESCRIPTIONnametextVolume namekeytextLabel keyvaluetextOptional label valueCOLUMNTYPEDESCRIPTIONnametextVolume namedrivertextVolume drivermount_pointtextMount pointtypetextVolume typeCOLUMNTYPEDESCRIPTIONdevice_idtextDevice IDdevice_nametextDevice nameimagetextPath to driver image filedescriptiontextDriver descriptionservicetextDriver service name, if one existsservice_keytextDriver service registry keyversiontextDriver versioninftextAssociated inf fileclasstextDevice/driver class nameprovidertextDriver providermanufacturertextDevice manufacturerdriver_keytextDriver keydatebigintDriver datesignedintegerWhether the driver is signed or notCOLUMNTYPEDESCRIPTIONinstance_idtextEC2 instance IDinstance_typetextEC2 instance typearchitecturetextHardware architecture of this EC2 instanceregiontextAWS region in which this instance launchedavailability_zonetextAvailability zone in which this instance launchedlocal_hostnametextPrivate IPv4 DNS hostname of the first interface of this instancelocal_ipv4textPrivate IPv4 address of the first interface of this instancemactextMAC address for the first network interface of this EC2 instancesecurity_groupstextComma separated list of security group namesiam_arntextIf there is an IAM role associated with the instance, contains instance profile ARNami_idtextAMI ID used to launch this EC2 instancereservation_idtextID of the reservationaccount_idtextAWS account ID which owns this EC2 instancessh_public_keytextSSH public key. Only available if supplied at instance launch timeCOLUMNTYPEDESCRIPTIONinstance_idtextEC2 instance IDkeytextTag keyvaluetextTag valueCOLUMNTYPEDESCRIPTIONtagintegerTag IDvalueintegerTag valueclassintegerClass (32 or 64)pathtextPath to ELF fileCOLUMNTYPEDESCRIPTIONclasstextClass type, 32 or 64bitabitextSection typeabi_versionintegerSection virtual address in memorytypetextOffset of section in filemachineintegerMachine typeversionintegerObject file versionentrybigintEntry point addressflagsintegerELF header flagspathtextPath to ELF fileCOLUMNTYPEDESCRIPTIONnametextSection nametypeintegerSection typevaddrintegerSection virtual address in memoryoffsetintegerOffset of section in filesizeintegerSize of sectionflagstextSection attributeslinktextLink to other sectionalignintegerSegment alignmentpathtextPath to ELF fileCOLUMNTYPEDESCRIPTIONnametextSegment type/nameoffsetintegerSegment offset in filevaddrintegerSegment virtual address in memorypsizeintegerSize of segment in filemsizeintegerSegment offset in memoryflagstextSegment attributesalignintegerSegment alignmentpathtextPath to ELF fileCOLUMNTYPEDESCRIPTIONnametextSymbol nameaddrintegerSymbol address (value)sizeintegerSize of objecttypetextSymbol typebindingtextBinding typeoffsetintegerSection table indextabletextTable name containing symbolpathtextPath to ELF fileCOLUMNTYPEDESCRIPTIONversionintegerVersion of EndpointSecurity eventseq_numbigintPer event sequence numberglobal_seq_numbigintGlobal sequence numberpidbigintProcess (or thread) IDpathtextPath of executed fileparentbigintParent process IDoriginal_parentbigintOriginal parent process ID in case of reparentingcmdlinetextCommand line arguments (argv)cmdline_countbigintNumber of command line argumentsenvtextEnvironment variables delimited by spacesenv_countbigintNumber of environment variablescwdtextThe process current working directoryuidbigintUser ID of the processeuidbigintEffective User ID of the processgidbigintGroup ID of the processegidbigintEffective Group ID of the processusernametextUsernamesigning_idtextSignature identifier of the processteam_idtextTeam identifier of thd processcdhashtextCodesigning hash of the processplatform_binaryintegerIndicates if the binary is Apple signed binary (1) or not (0)exit_codeintegerExit code of a process in case of an exit eventchild_pidbigintProcess ID of a child process in case of a fork eventtimebigintTime of execution in UNIX timeevent_typetextType of EndpointSecurity eventeidtextEvent IDCOLUMNTYPEDESCRIPTIONaddresstextIP address mappinghostnamestextRaw hosts mappingpid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONnametextProtocol namenumberintegerProtocol numberaliastextProtocol aliascommenttextComment with protocol descriptionCOLUMNTYPEDESCRIPTIONnametextService nameportintegerService port numberprotocoltextTransport protocol (TCP/UDP)aliasestextOptional space separated list of other names for a servicecommenttextOptional comment for a service.COLUMNTYPEDESCRIPTIONenabledintegerIs the Event Tap enabledevent_tap_idintegerUnique ID for the Tapevent_tappedtextThe mask that identifies the set of events to be observed.process_being_tappedintegerThe process ID of the target applicationtapping_processintegerThe process ID of the application that created the event tap.COLUMNTYPEDESCRIPTIONnametextDescription for name columnpointsintegerThis is a signed SQLite int columnsizebigintThis is a signed SQLite bigint columnactiontextAction performed in generationidintegerAn index of some sortpathtextPath of exampleCOLUMNTYPEDESCRIPTIONpathtextAbsolute file pathdirectorytextDirectory of file(s)keytextName of the value generated from the extended attributevaluetextThe parsed information from the attributebase64integer1 if the value is base64 encoded else 0COLUMNTYPEDESCRIPTIONfantextFan numbernametextFan nameactualintegerActual speedminintegerMinimum speedmaxintegerMaximum speedtargetintegerTarget speedCOLUMNTYPEDESCRIPTIONnametextModule namesizeintegerSize of module contentrefsintegerModule reverse dependenciesaddresstextKernel module addressCOLUMNTYPEDESCRIPTIONpathtextAbsolute file pathdirectorytextDirectory of file(s)filenametextName portion of file pathinodebigintFilesystem inode numberuidbigintOwning user IDgidbigintOwning group IDmodetextPermission bitsdevicebigintDevice ID (optional)sizebigintSize of file in bytesblock_sizeintegerBlock size of filesystematimebigintLast access timemtimebigintLast modification timectimebigintLast status change timebtimebigint(B)irth or (cr)eate timehard_linksintegerNumber of hard linkssymlinkinteger1 if the path is a symlink, otherwise 0typetextFile statusattributestextFile attrib string. See: https://ss64.com/nt/attrib.htmlvolume_serialtextVolume serial numberfile_idtextfile IDfile_versiontextFile versionproduct_versiontextFile product versionbsd_flagstextThe BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPENDpid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONtarget_pathtextThe path associated with the eventcategorytextThe category of the file defined in the configactiontextChange action (UPDATE, REMOVE, etc)transaction_idbigintID used during bulk updateinodebigintFilesystem inode numberuidbigintOwning user IDgidbigintOwning group IDmodetextPermission bitssizebigintSize of file in bytesatimebigintLast access timemtimebigintLast modification timectimebigintLast status change timemd5textThe MD5 of the file after changesha1textThe SHA1 of the file after changesha256textThe SHA256 of the file after changehashedinteger1 if the file was hashed, 0 if not, -1 if hashing failedtimebigintTime of file eventeidtextEvent IDCOLUMNTYPEDESCRIPTIONuidbigintThe local user that owns the addonnametextAddon display nameidentifiertextAddon identifiercreatortextAddon-supported creator stringtypetextExtension, addon, webappversiontextAddon-supplied version stringdescriptiontextAddon-supplied description stringsource_urltextURL that installed the addonvisibleinteger1 If the addon is shown in browser else 0activeinteger1 If the addon is active else 0disabledinteger1 If the addon is application-disabled else 0autoupdateinteger1 If the addon applies background updates else 0nativeinteger1 If the addon includes binary components else 0locationtextGlobal, profile locationpathtextPath to plugin bundleCOLUMNTYPEDESCRIPTIONassessments_enabledinteger1 If a Gatekeeper is enabled else 0dev_id_enabledinteger1 If a Gatekeeper allows execution from identified developers else 0versiontextVersion of Gatekeeper's gke.bundleopaque_versiontextVersion of Gatekeeper's gkopaque.bundleCOLUMNTYPEDESCRIPTIONpathtextPath of executable allowed to runrequirementtextCode signing requirement languagectimedoubleLast change timemtimedoubleLast modification timeCOLUMNTYPEDESCRIPTIONgidbigintUnsigned int64 group IDgid_signedbigintA signed int64 version of gidgroupnametextCanonical local group namegroup_sidtextUnique group IDcommenttextRemarks or comments associated with the groupis_hiddenintegerIsHidden attribute set in OpenDirectorypid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONactiontextRemove, insert, change properties, etcpathtextLocal device path assigned (optional)typetextType of hardware and hardware eventdrivertextDriver claiming the devicevendortextHardware device vendorvendor_idtextHex encoded Hardware vendor identifiermodeltextHardware device modelmodel_idtextHex encoded Hardware model identifierserialtextDevice serial (optional)revisiontextDevice revision (optional)timebigintTime of hardware eventeidtextEvent IDCOLUMNTYPEDESCRIPTIONpathtextMust provide a path or directorydirectorytextMust provide a path or directorymd5textMD5 hash of provided filesystem datasha1textSHA1 hash of provided filesystem datasha256textSHA256 hash of provided filesystem datassdeeptextssdeep hash of provided filesystem datapid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONnametextPackage namepathtextPackage install pathversiontextCurrent 'linked' versionprefixtextHomebrew install prefixCOLUMNTYPEDESCRIPTIONversiontextThe version number of the Device Guard build.instance_identifiertextThe instance ID of Device Guard.vbs_statustextThe status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.code_integrity_policy_enforcement_statustextThe status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.umci_policy_statustextThe status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.COLUMNTYPEDESCRIPTIONboot_uuidtextBoot UUID of the iBridge controllercoprocessor_versiontextThe manufacturer and chip versionfirmware_versiontextThe build version of the firmwareunique_chip_idtextUnique id of the iBridge controllerCOLUMNTYPEDESCRIPTIONnametextExtension display nameregistry_pathtextExtension identifierversiontextVersion of the executablepathtextPath to executableCOLUMNTYPEDESCRIPTIONversiontextIntel ME versionCOLUMNTYPEDESCRIPTIONinterfacetextInterface nameaddresstextSpecific address for interfacemasktextInterface netmaskbroadcasttextBroadcast address for the interfacepoint_to_pointtextPtP address for the interfacetypetextType of address. One of dhcp, manual, auto, other, unknownfriendly_nametextThe friendly display name of the interface.COLUMNTYPEDESCRIPTIONinterfacetextInterface namemactextMAC of interface (optional)typeintegerInterface type (includes virtual)mtuintegerNetwork MTUmetricintegerMetric based on the speed of the interfaceflagsintegerFlags (netdevice) for the deviceipacketsbigintInput packetsopacketsbigintOutput packetsibytesbigintInput bytesobytesbigintOutput bytesierrorsbigintInput errorsoerrorsbigintOutput errorsidropsbigintInput dropsodropsbigintOutput dropscollisionsbigintPacket Collisions detectedlast_changebigintTime of last device modification (optional)link_speedbigintInterface speed in Mb/spci_slottextPCI slot numberfriendly_nametextThe friendly display name of the interface.descriptiontextShort description of the object a one-line string.manufacturertextName of the network adapter's manufacturer.connection_idtextName of the network connection as it appears in the Network Connections Control Panel program.connection_statustextState of the network adapter connection to the network.enabledintegerIndicates whether the adapter is enabled or not.physical_adapterintegerIndicates whether the adapter is a physical or a logical adapter.speedintegerEstimate of the current bandwidth in bits per second.servicetextThe name of the service the network adapter uses.dhcp_enabledintegerIf TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.dhcp_lease_expirestextExpiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.dhcp_lease_obtainedtextDate and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server.dhcp_servertextIP address of the dynamic host configuration protocol (DHCP) server.dns_domaintextOrganization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'.dns_domain_suffix_search_ordertextArray of DNS domain suffixes to be appended to the end of host names during name resolution.dns_host_nametextHost name used to identify the local computer for authentication by some utilities.dns_server_search_ordertextArray of server IP addresses to be used in querying for DNS servers.COLUMNTYPEDESCRIPTIONinterfacetextInterface namehop_limitintegerCurrent Hop Limitforwarding_enabledintegerEnable IP forwardingredirect_acceptintegerAccept ICMP redirect messagesrtadv_acceptintegerAccept ICMP Router AdvertisementCOLUMNTYPEDESCRIPTIONnametextDevice node nameclasstextBest matching device class (most-specific category)idbigintIOKit internal registry IDparentbigintParent device registry IDdevice_pathtextDevice tree pathserviceinteger1 if the device conforms to IOService else 0busy_stateinteger1 if the device is in a busy state else 0retain_countintegerThe device reference countdepthintegerDevice nested depthCOLUMNTYPEDESCRIPTIONnametextDefault name of the nodeclasstextBest matching device class (most-specific category)idbigintIOKit internal registry IDparentbigintParent registry IDbusy_stateinteger1 if the node is in a busy state else 0retain_countintegerThe node reference countdepthintegerNode nested depthCOLUMNTYPEDESCRIPTIONfilter_nametextPacket matching filter table name.chaintextSize of module content.policytextPolicy that applies for this rule.targettextTarget that applies for this rule.protocolintegerProtocol number identification.src_porttextProtocol source port(s).dst_porttextProtocol destination port(s).src_iptextSource IP address.src_masktextSource IP address mask.inifacetextInput interface for the rule.iniface_masktextInput interface mask for the rule.dst_iptextDestination IP address.dst_masktextDestination IP address mask.outifacetextOutput interface for the rule.outiface_masktextOutput interface mask for the rule.matchtextMatching rule that applies.packetsintegerNumber of matching packets for this rule.bytesintegerNumber of matching bytes for this rule.COLUMNTYPEDESCRIPTIONidxintegerExtension load tag or indexrefsintegerReference countsizebigintBytes of wired memory used by extensionnametextExtension labelversiontextExtension versionlinked_againsttextIndexes of extensions this extension is linked againstpathtextOptional path to extension bundleCOLUMNTYPEDESCRIPTIONversiontextKernel versionargumentstextKernel argumentspathtextKernel pathdevicetextKernel device identifierCOLUMNTYPEDESCRIPTIONnametextModule namesizebigintSize of module contentused_bytextModule reverse dependenciesstatustextKernel module statusaddresstextKernel module addressCOLUMNTYPEDESCRIPTIONpathtextLocation of log filetimetextFormatted time of the eventregisterstextA space delimited line of register:value pairsframe_backtracetextBacktrace of the crashed modulemodule_backtracetextModules appearing in the crashed module's backtracedependenciestextModule dependencies existing in crashed module's backtracenametextProcess name corresponding to crashed threados_versiontextVersion of the operating systemkernel_versiontextVersion of the system kernelsystem_modeltextPhysical system model, for example 'MacBookPro12,1 (Mac-E43C1C25D4880AD6)'uptimebigintSystem uptime at kernel panic in nanosecondslast_loadedtextLast loaded module before paniclast_unloadedtextLast unloaded module before panicCOLUMNTYPEDESCRIPTIONkeychain_pathtextThe path of the keychainauthorizationstextA space delimited set of authorization attributespathtextThe path of the authorized applicationdescriptiontextThe description included with the ACL entrylabeltextAn optional label tag that may be included with the keychain entryCOLUMNTYPEDESCRIPTIONlabeltextGeneric item namedescriptiontextOptional item descriptioncommenttextOptional keychain commentcreatedtextData item was createdmodifiedtextDate of last modificationtypetextKeychain item type (class)pathtextPath to keychain containing itemCOLUMNTYPEDESCRIPTIONuidbigintThe local user that owns the known_hosts filekeytextparsed authorized keys linekey_filetextPath to known_hosts fileCOLUMNTYPEDESCRIPTIONkva_shadow_enabledintegerKernel Virtual Address shadowing is enabled.kva_shadow_user_globalintegerUser pages are marked as global.kva_shadow_pcidintegerKernel VA PCID flushing optimization is enabled.kva_shadow_inv_pcidintegerKernel VA INVPCID is enabled.bp_mitigationsintegerBranch Prediction mitigations are enabled.bp_system_pol_disabledintegerBranch Predictions are disabled via system policy.bp_microcode_disabledintegerBranch Predictions are disabled due to lack of microcode update.cpu_spec_ctrl_supportedintegerSPEC_CTRL MSR supported by CPU Microcode.ibrs_support_enabledintegerWindows uses IBRS.stibp_support_enabledintegerWindows uses STIBP.cpu_pred_cmd_supportedintegerPRED_CMD MSR supported by CPU Microcode.COLUMNTYPEDESCRIPTIONusernametextEntry usernamettytextEntry terminalpidintegerProcess (or thread) IDtypeintegerEntry type, according to ut_type types (utmp.h)type_nametextEntry type name, according to ut_type types (utmp.h)timeintegerEntry timestamphosttextEntry hostnameCOLUMNTYPEDESCRIPTIONpathtextPath to daemon or agent plistnametextFile name of plist (used by launchd)labeltextDaemon or agent service nameprogramtextPath to target programrun_at_loadtextShould the program run on launch loadkeep_alivetextShould the process be restarted if killedon_demandtextDeprecated key, replaced by keep_alivedisabledtextSkip loading this daemon or agent on bootusernametextRun this daemon or agent as this usernamegroupnametextRun this daemon or agent as this groupstdout_pathtextPipe stdout to a target pathstderr_pathtextPipe stderr to a target pathstart_intervaltextFrequency to run in secondsprogram_argumentstextCommand line arguments passed to programwatch_pathstextKey that launches daemon or agent if path is modifiedqueue_directoriestextSimilar to watch_paths but only with non-empty directoriesinetd_compatibilitytextRun this daemon or agent as it was launched from inetdstart_on_mounttextRun daemon or agent every time a filesystem is mountedroot_directorytextKey used to specify a directory to chroot to before launchworking_directorytextKey used to specify a directory to chdir to before launchprocess_typetextKey describes the intended purpose of the jobCOLUMNTYPEDESCRIPTIONlabeltextDaemon or agent service namekeytextName of the override keyvaluetextOverridden valueuidbigintUser ID applied to the override, 0 applies to allpathtextPath to daemon or agent plistCOLUMNTYPEDESCRIPTIONpidintegerProcess (or thread) IDportintegerTransport layer portprotocolintegerTransport protocol (TCP/UDP)familyintegerNetwork protocol (IPv4, IPv6)addresstextSpecific address for bindfdbigintSocket file descriptor numbersocketbigintSocket handle or inode numberpathtextPath for UNIX domain socketsnet_namespacetextThe inode number of the network namespaceCOLUMNTYPEDESCRIPTIONinterfacetextInterface nameridintegerNeighbor chassis indexchassis_id_typetextNeighbor chassis ID typechassis_idtextNeighbor chassis ID valuechassis_sysnametextCPU brand string, contains vendor and modelchassis_sys_descriptionintegerMax number of CPU physical coreschassis_bridge_capability_availableintegerChassis bridge capability availabilitychassis_bridge_capability_enabledintegerIs chassis bridge capability enabled.chassis_router_capability_availableintegerChassis router capability availabilitychassis_router_capability_enabledintegerChassis router capability enabledchassis_repeater_capability_availableintegerChassis repeater capability availabilitychassis_repeater_capability_enabledintegerChassis repeater capability enabledchassis_wlan_capability_availableintegerChassis wlan capability availabilitychassis_wlan_capability_enabledintegerChassis wlan capability enabledchassis_tel_capability_availableintegerChassis telephone capability availabilitychassis_tel_capability_enabledintegerChassis telephone capability enabledchassis_docsis_capability_availableintegerChassis DOCSIS capability availabilitychassis_docsis_capability_enabledintegerChassis DOCSIS capability enabledchassis_station_capability_availableintegerChassis station capability availabilitychassis_station_capability_enabledintegerChassis station capability enabledchassis_other_capability_availableintegerChassis other capability availabilitychassis_other_capability_enabledintegerChassis other capability enabledchassis_mgmt_ipstextComma delimited list of chassis management IPSport_id_typetextPort ID typeport_idtextPort ID valueport_descriptiontextPort descriptionport_ttlbigintAge of neighbor portport_mfsbigintPort max frame sizeport_aggregation_idtextPort aggregation IDport_autoneg_supportedintegerAuto negotiation supportedport_autoneg_enabledintegerIs auto negotiation enabledport_mau_typetextMAU typeport_autoneg_10baset_hd_enabledinteger10Base-T HD auto negotiation enabledport_autoneg_10baset_fd_enabledinteger10Base-T FD auto negotiation enabledport_autoneg_100basetx_hd_enabledinteger100Base-TX HD auto negotiation enabledport_autoneg_100basetx_fd_enabledinteger100Base-TX FD auto negotiation enabledport_autoneg_100baset2_hd_enabledinteger100Base-T2 HD auto negotiation enabledport_autoneg_100baset2_fd_enabledinteger100Base-T2 FD auto negotiation enabledport_autoneg_100baset4_hd_enabledinteger100Base-T4 HD auto negotiation enabledport_autoneg_100baset4_fd_enabledinteger100Base-T4 FD auto negotiation enabledport_autoneg_1000basex_hd_enabledinteger1000Base-X HD auto negotiation enabledport_autoneg_1000basex_fd_enabledinteger1000Base-X FD auto negotiation enabledport_autoneg_1000baset_hd_enabledinteger1000Base-T HD auto negotiation enabledport_autoneg_1000baset_fd_enabledinteger1000Base-T FD auto negotiation enabledpower_device_typetextDot3 power device typepower_mdi_supportedintegerMDI power supportedpower_mdi_enabledintegerIs MDI power enabledpower_paircontrol_enabledintegerIs power pair control enabledpower_pairstextDot3 power pairspower_classtextPower classpower_8023at_enabledintegerIs 802.3at enabledpower_8023at_power_typetext802.3at power typepower_8023at_power_sourcetext802.3at power sourcepower_8023at_power_prioritytext802.3at power prioritypower_8023at_power_allocatedtext802.3at power allocatedpower_8023at_power_requestedtext802.3at power requestedmed_device_typetextChassis MED typemed_capability_capabilitiesintegerIs MED capabilities enabledmed_capability_policyintegerIs MED policy capability enabledmed_capability_locationintegerIs MED location capability enabledmed_capability_mdi_pseintegerIs MED MDI PSE capability enabledmed_capability_mdi_pdintegerIs MED MDI PD capability enabledmed_capability_inventoryintegerIs MED inventory capability enabledmed_policiestextComma delimited list of MED policiesvlanstextComma delimited list of vlan idspvidtextPrimary VLAN idppvids_supportedtextComma delimited list of supported PPVIDsppvids_enabledtextComma delimited list of enabled PPVIDspidstextComma delimited list of PIDsCOLUMNTYPEDESCRIPTIONperiodtextPeriod over which the average is calculated.averagetextLoad average over the specified period.COLUMNTYPEDESCRIPTIONenabledinteger1 if Location Services are enabled, else 0COLUMNTYPEDESCRIPTIONtypetextLogin typeusertextUser login namettytextDevice namehosttextRemote hostnametimebigintTime entry was madepidintegerProcess (or thread) IDsidtextThe user's unique security identifierregistry_hivetextHKEY_USERS registry hiveCOLUMNTYPEDESCRIPTIONdevice_idtextThe drive id, usually the drive name, e.g., 'C:'.typetextDeprecated (always 'Unknown').descriptiontextThe canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'.free_spacebigintThe amount of free space, in bytes, of the drive (-1 on failure).sizebigintThe total amount of space, in bytes, of the drive (-1 on failure).file_systemtextThe file system of the drive.boot_partitionintegerTrue if Windows booted from this drive.COLUMNTYPEDESCRIPTIONlogon_idintegerA locally unique identifier (LUID) that identifies a logon session.usertextThe account name of the security principal that owns the logon session.logon_domaintextThe name of the domain used to authenticate the owner of the logon session.authentication_packagetextThe authentication package used to authenticate the owner of the logon session.logon_typetextThe logon method.session_idintegerThe Terminal Services session identifier.logon_sidtextThe user's security identifier (SID).logon_timebigintThe time the session owner logged on.logon_servertextThe name of the server used to authenticate the owner of the logon session.dns_domain_nametextThe DNS name for the owner of the logon session.upntextThe user principal name (UPN) for the owner of the logon session.logon_scripttextThe script used for logging on.profile_pathtextThe home directory for the logon session.home_directorytextThe home directory for the logon session.home_directory_drivetextThe drive location of the home directory of the logon session.COLUMNTYPEDESCRIPTIONnametextName of the certificatetypetextType of the certificatefingerprinttextSHA256 hash of the certificatecertificatetextCertificate contentCOLUMNTYPEDESCRIPTIONserver_nametextName of the LXD server nodeenabledintegerWhether clustering enabled (1) or not (0) on this nodemember_config_entitytextType of configuration parameter for this nodemember_config_nametextName of configuration parametermember_config_keytextConfig keymember_config_valuetextConfig valuemember_config_descriptiontextConfig descriptionCOLUMNTYPEDESCRIPTIONserver_nametextName of the LXD server nodeurltextURL of the nodedatabaseintegerWhether the server is a database node (1) or not (0)statustextStatus of the node (Online/Offline)messagetextMessage from the node (Online/Offline)COLUMNTYPEDESCRIPTIONidtextImage IDarchitecturetextTarget architecture for the imageostextOS on which image is basedreleasetextOS release version on which the image is baseddescriptiontextImage descriptionaliasestextComma-separated list of image aliasesfilenametextFilename of the image filesizebigintSize of image in bytesauto_updateintegerWhether the image auto-updates (1) or not (0)cachedintegerWhether image is cached (1) or not (0)publicintegerWhether image is public (1) or not (0)created_attextISO time of image creationexpires_attextISO time of image expirationuploaded_attextISO time of image uploadlast_used_attextISO time for the most recent use of this image in terms of container spawnupdate_source_servertextServer for image updateupdate_source_protocoltextProtocol used for image information update and image import from source serverupdate_source_certificatetextCertificate for update source serverupdate_source_aliastextAlias of image at update source serverCOLUMNTYPEDESCRIPTIONnametextInstance namekeytextConfiguration parameter namevaluetextConfiguration parameter valueCOLUMNTYPEDESCRIPTIONnametextInstance namedevicetextName of the devicedevice_typetextDevice typekeytextDevice info param namevaluetextDevice info param valueCOLUMNTYPEDESCRIPTIONnametextInstance namestatustextInstance state (running, stopped, etc.)statefulintegerWhether the instance is stateful(1) or not(0)ephemeralintegerWhether the instance is ephemeral(1) or not(0)created_attextISO time of creationbase_imagetextID of image used to launch this instancearchitecturetextInstance architectureostextThe OS of this instancedescriptiontextInstance descriptionpidintegerInstance's process IDprocessesintegerNumber of processes running inside this instanceCOLUMNTYPEDESCRIPTIONnametextName of the networktypetextType of networkmanagedinteger1 if network created by LXD, 0 otherwiseipv4_addresstextIPv4 addressipv6_addresstextIPv6 addressused_bytextURLs for containers using this networkbytes_receivedbigintNumber of bytes received on this networkbytes_sentbigintNumber of bytes sent on this networkpackets_receivedbigintNumber of packets received on this networkpackets_sentbigintNumber of packets sent on this networkhwaddrtextHardware address for this networkstatetextNetwork statusmtuintegerMTU sizeCOLUMNTYPEDESCRIPTIONnametextName of the storage pooldrivertextStorage driversourcetextStorage pool sourcesizetextSize of the storage poolspace_usedbigintStorage space used in bytesspace_totalbigintTotal available storage space in bytes for this storage poolinodes_usedbigintNumber of inodes usedinodes_totalbigintTotal number of inodes available in this storage poolCOLUMNTYPEDESCRIPTIONpathtextAbsolute path to target filemagic_db_filestextColon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgcdatatextMagic number data from libmagicmime_typetextMIME type data from libmagicmime_encodingtextMIME encoding data from libmagicCOLUMNTYPEDESCRIPTIONdomaintextSystem or manager-chosen domain keyuuidtextOptional UUID assigned to policy setnametextPolicy key namevaluetextPolicy valueusernametextPolicy applies only this usermanualinteger1 if policy was loaded manually, otherwise 0COLUMNTYPEDESCRIPTIONdevice_nametextmd device namestatustextCurrent state of the arrayraid_levelintegerCurrent raid level of the arraysizebigintsize of the array in blockschunk_sizebigintchunk size in bytesraid_disksintegerNumber of configured RAID disks in arraynr_raid_disksintegerNumber of partitions or disk devices to comprise the arrayworking_disksintegerNumber of working disks in arrayactive_disksintegerNumber of active disks in arrayfailed_disksintegerNumber of failed disks in arrayspare_disksintegerNumber of idle disks in arraysuperblock_statetextState of the superblocksuperblock_versiontextVersion of the superblocksuperblock_update_timebigintUnix timestamp of last updatebitmap_on_memtextPages allocated in in-memory bitmap, if enabledbitmap_chunk_sizetextBitmap chunk sizebitmap_external_filetextExternal referenced bitmap filerecovery_progresstextProgress of the recovery activityrecovery_finishtextEstimated duration of recovery activityrecovery_speedtextSpeed of recovery activityresync_progresstextProgress of the resync activityresync_finishtextEstimated duration of resync activityresync_speedtextSpeed of resync activityreshape_progresstextProgress of the reshape activityreshape_finishtextEstimated duration of reshape activityreshape_speedtextSpeed of reshape activitycheck_array_progresstextProgress of the check array activitycheck_array_finishtextEstimated duration of the check array activitycheck_array_speedtextSpeed of the check array activityunused_devicestextUnused devicesothertextOther information associated with array from /proc/mdstatCOLUMNTYPEDESCRIPTIONmd_device_nametextmd device namedrive_nametextDrive device nameslotintegerSlot position of diskstatetextState of the driveCOLUMNTYPEDESCRIPTIONnametextName of personality supported by kernelCOLUMNTYPEDESCRIPTIONpathtextPath of the file returned from spotlightquerytextThe query that was run to find the fileCOLUMNTYPEDESCRIPTIONpathtextPath of the filekeytextName of the metadata keyvaluetextValue stored in the metadata keyvaluetypetextCoreFoundation type of data stored in valueCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the structurememory_array_handletextHandle of the memory array associated with this structurestarting_addresstextPhysical stating address, in kilobytes, of a range of memory mapped to physical memory arrayending_addresstextPhysical ending address of last kilobyte of a range of memory mapped to physical memory arraypartition_widthintegerNumber of memory devices that form a single row of memory for the address partition of this structureCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the arraylocationtextPhysical location of the memory arrayusetextFunction for which the array is usedmemory_error_correctiontextPrimary hardware error correction or detection method supportedmax_capacityintegerMaximum capacity of array in gigabytesmemory_error_info_handletextHandle, or instance number, associated with any error that was detected for the arraynumber_memory_devicesintegerNumber of memory devices on arrayCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the structurememory_device_handletextHandle of the memory device structure associated with this structurememory_array_mapped_address_handletextHandle of the memory array mapped address to which this device range is mapped tostarting_addresstextPhysical stating address, in kilobytes, of a range of memory mapped to physical memory arrayending_addresstextPhysical ending address of last kilobyte of a range of memory mapped to physical memory arraypartition_row_positionintegerIdentifies the position of the referenced memory device in a row of the address partitioninterleave_positionintegerThe position of the device in a interleave, i.e. 0 indicates non-interleave, 1 indicates 1st interleave, 2 indicates 2nd interleave, etc.interleave_data_depthintegerThe max number of consecutive rows from memory device that are accessed in a single interleave transfer; 0 indicates device is non-interleaveCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the structure in SMBIOSarray_handletextThe memory array that the device is attached toform_factortextImplementation form factor for this memory devicetotal_widthintegerTotal width, in bits, of this memory device, including any check or error-correction bitsdata_widthintegerData width, in bits, of this memory devicesizeintegerSize of memory device in MegabytesetintegerIdentifies if memory device is one of a set of devices. A value of 0 indicates no set affiliation.device_locatortextString number of the string that identifies the physically-labeled socket or board position where the memory device is locatedbank_locatortextString number of the string that identifies the physically-labeled bank where the memory device is locatedmemory_typetextType of memory usedmemory_type_detailstextAdditional details for memory devicemax_speedintegerMax speed of memory device in megatransfers per second (MT/s)configured_clock_speedintegerConfigured speed of memory device in megatransfers per second (MT/s)manufacturertextManufacturer ID stringserial_numbertextSerial number of memory deviceasset_tagtextManufacturer specific asset tag of memory devicepart_numbertextManufacturer specific serial number of memory devicemin_voltageintegerMinimum operating voltage of device in millivoltsmax_voltageintegerMaximum operating voltage of device in millivoltsconfigured_voltageintegerConfigured operating voltage of device in millivoltsCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the structureerror_typetexttype of error associated with current error status for array or deviceerror_granularitytextGranularity to which the error can be resolvederror_operationtextMemory access operation that caused the errorvendor_syndrometextVendor specific ECC syndrome or CRC data associated with the erroneous accessmemory_array_error_addresstext32 bit physical address of the error based on the addressing of the bus to which the memory array is connecteddevice_error_addresstext32 bit physical address of the error relative to the start of the failing memory address, in byteserror_resolutiontextRange, in bytes, within which this error can be determined, when an error address is givenCOLUMNTYPEDESCRIPTIONmemory_totalbigintTotal amount of physical RAM, in bytesmemory_freebigintThe amount of physical RAM, in bytes, left unused by the systembuffersbigintThe amount of physical RAM, in bytes, used for file bufferscachedbigintThe amount of physical RAM, in bytes, used as cache memoryswap_cachedbigintThe amount of swap, in bytes, used as cache memoryactivebigintThe total amount of buffer or page cache memory, in bytes, that is in active useinactivebigintThe total amount of buffer or page cache memory, in bytes, that are free and availableswap_totalbigintThe total amount of swap available, in bytesswap_freebigintThe total amount of swap free, in bytesCOLUMNTYPEDESCRIPTIONnametextRegion namestarttextStart address of memory regionendtextEnd address of memory regionCOLUMNTYPEDESCRIPTIONdevicetextMounted devicedevice_aliastextMounted device aliaspathtextMounted device pathtypetextMounted device typeblocks_sizebigintBlock size in bytesblocksbigintMounted device used blocksblocks_freebigintMounted device free blocksblocks_availablebigintMounted device available blocksinodesbigintMounted device used inodesinodes_freebigintMounted device free inodesflagstextMounted device flagsCOLUMNTYPEDESCRIPTIONprocessor_numberbigintThe processor number as reported in /proc/cpuinfoturbo_disabledbigintWhether the turbo feature is disabled.turbo_ratio_limitbigintThe turbo feature ratio limit.platform_infobigintPlatform information.perf_ctlbigintPerformance setting for the processor.perf_statusbigintPerformance status for the processor.feature_controlbigintBitfield controlling enabled features.rapl_power_limitbigintRun Time Average Power Limiting power limit.rapl_energy_statusbigintRun Time Average Power Limiting energy status.rapl_power_unitsbigintRun Time Average Power Limiting power units.COLUMNTYPEDESCRIPTIONsharetextFilesystem path to the shareoptionstextOptions string set on the export sharereadonlyinteger1 if the share is exported readonly else 0COLUMNTYPEDESCRIPTIONnametextPackage display nameversiontextPackage supplied versiondescriptiontextPackage supplied descriptionauthortextPackage author namelicensetextLicense for packagepathtextModule's package.json pathdirectorytextNode module's directory where this package is locatedpid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONnametextThe label by which the object is known.client_site_nametextThe name of the site where the domain controller is configured.dc_site_nametextThe name of the site where the domain controller is located.dns_forest_nametextThe name of the root of the DNS tree.domain_controller_addresstextThe IP Address of the discovered domain controller..domain_controller_nametextThe name of the discovered domain controller.domain_nametextThe name of the domain.statustextThe current status of the domain object.COLUMNTYPEDESCRIPTIONpathtextPath to the file or directory.typetextType of access mode for the access control entry.principaltextUser or group to which the ACE applies.accesstextSpecific permissions that indicate the rights described by the ACE.inherited_fromtextThe inheritance policy of the ACE.COLUMNTYPEDESCRIPTIONactiontextChange action (Write, Delete, etc)categorytextThe category that the event originated fromold_pathtextOld path (renames only)pathtextPathrecord_timestamptextJournal record timestamprecord_usntextThe update sequence number that identifies the journal recordnode_ref_numbertextThe ordinal that associates a journal record with a filenameparent_ref_numbertextThe ordinal that associates a journal record with a filename's parent directorydrive_lettertextThe drive letter identifying the source journalfile_attributestextFile attributespartialbigintSet to 1 if either path or old_path only contains the file or folder nametimebigintTime of file eventeidtextEvent IDCOLUMNTYPEDESCRIPTIONnametextVariable nametypetextData type (CFData, CFString, etc)valuetextRaw variable dataCOLUMNTYPEDESCRIPTIONhandletextHandle, or instance number, associated with the Type 11 structurenumberintegerThe string index of the structurevaluetextThe value of the OEM stringCOLUMNTYPEDESCRIPTIONapplicationtextAssociated Office applicationversiontextOffice application version numberpathtextFile pathlast_opened_timebigintMost recent opened time file was openedsidtextUser SIDCOLUMNTYPEDESCRIPTIONnametextDistribution or product nameversiontextPretty, suitable for presentation, OS versionmajorintegerMajor release versionminorintegerMinor release versionpatchintegerOptional patch releasebuildtextOptional build-specific or variant stringplatformtextOS Platform or IDplatform_liketextClosely related platformscodenametextOS version codenamearchtextOS Architectureinstall_datebigintThe install date of the OS.pid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONnametextEvent publisher or subscriber namepublishertextName of the associated publishertypetextEither publisher or subscribersubscriptionsintegerNumber of subscriptions the publisher received or subscriber usedeventsintegerNumber of events emitted or received since osquery startedrefreshesintegerPublisher only: number of runloop restartsactiveinteger1 if the publisher or subscriber is active else 0COLUMNTYPEDESCRIPTIONuuidbigintThe transient ID assigned for communicationnametextExtension's nameversiontextExtension's versionsdk_versiontextosquery SDK version used to build the extensionpathtextPath of the extension's Thrift connection or library pathtypetextSDK extension type: extension or moduleCOLUMNTYPEDESCRIPTIONnametextFlag nametypetextFlag typedescriptiontextFlag descriptiondefault_valuetextFlag default valuevaluetextFlag valueshell_onlyintegerIs the flag shell only?COLUMNTYPEDESCRIPTIONpidintegerProcess (or thread/handle) IDuuidtextUnique ID provided by the systeminstance_idtextUnique, long-lived ID per instance of osqueryversiontextosquery toolkit versionconfig_hashtextHash of the working configuration stateconfig_validinteger1 if the config was loaded and considered valid, else 0extensionstextosquery extensions statusbuild_platformtextosquery toolkit build platformbuild_distrotextosquery toolkit platform distribution name (os version)start_timeintegerUNIX time in seconds when the process startedwatcherintegerProcess (or thread/handle) ID of optional watcher processplatform_maskintegerThe osquery platform bitmaskCOLUMNTYPEDESCRIPTIONnametextThe given name for this query packplatformtextPlatforms this query is supported onversiontextMinimum osquery version that this query will run onshardintegerShard restriction limit, 1-100, 0 meaning no restrictiondiscovery_cache_hitsintegerThe number of times that the discovery query used cached values since the last time the config was reloadeddiscovery_executionsintegerThe number of times that the discovery queries have been executed since the last time the config was reloadedactiveintegerWhether this pack is active (the version, platform and discovery queries match) yes=1, no=0.COLUMNTYPEDESCRIPTIONregistrytextName of the osquery registrynametextName of the plugin itemowner_uuidintegerExtension route UUID (0 for core)internalinteger1 If the plugin is internal else 0activeinteger1 If this plugin is active else 0COLUMNTYPEDESCRIPTIONnametextThe given name for this queryquerytextThe exact query to runintervalintegerThe interval in seconds to run this query, not an exact intervalexecutionsbigintNumber of times the query was executedlast_executedbigintUNIX time stamp in seconds of the last completed executiondenylistedinteger1 if the query is denylisted else 0output_sizebigintTotal number of bytes generated by the querywall_timebigintTotal wall time spent executinguser_timebigintTotal user time spent executingsystem_timebigintTotal system time spent executingaverage_memorybigintAverage private memory left after executingCOLUMNTYPEDESCRIPTIONfilepathtextPackage file or directoryuidintegerExpected user of file or directorygidintegerExpected group of file or directorymodeintegerExpected permissionssizebigintExpected file sizemodified_timeintegerTimestamp the file was installedpathtextPath of package bomCOLUMNTYPEDESCRIPTIONpackage_idtextLabel packageIdentifierstimeintegerLabel date as UNIX timestampnametextPackage display nameversiontextPackage display versionsourcetextInstall source: usually the installer process namecontent_typetextPackage content_type (optional)COLUMNTYPEDESCRIPTIONpackage_idtextPackage domain identifierpackage_filenametextFilename of original .pkg fileversiontextInstalled package versionlocationtextOptional relative install path on volumeinstall_timedoubleTimestamp of install timeinstaller_nametextName of installer processpathtextPath of receipt plistCOLUMNTYPEDESCRIPTIONcsnametextThe name of the host the patch is installed on.hotfix_idtextThe KB ID of the patch.captiontextShort description of the patch.descriptiontextFuller description of the patch.fix_commentstextAdditional comments about the patch.installed_bytextThe system context in which the patch as installed.install_datetextIndicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.installed_ontextThe date when the patch was installed.COLUMNTYPEDESCRIPTIONpci_slottextPCI Device used slotpci_classtextPCI Device classdrivertextPCI Device used drivervendortextPCI Device vendorvendor_idtextHex encoded PCI Device vendor identifiermodeltextPCI Device modelmodel_idtextHex encoded PCI Device model identifierpci_class_idtextPCI Device class ID in hex formatpci_subclass_idtextPCI Device subclass in hex formatpci_subclasstextPCI Device subclasssubsystem_vendor_idtextVendor ID of PCI device subsystemsubsystem_vendortextVendor of PCI device subsystemsubsystem_model_idtextModel ID of PCI device subsystemsubsystem_modeltextDevice description of PCI device subsystemCOLUMNTYPEDESCRIPTIONnametextName of the physical diskavg_disk_bytes_per_readbigintAverage number of bytes transferred from the disk during read operationsavg_disk_bytes_per_writebigintAverage number of bytes transferred to the disk during write operationsavg_disk_read_queue_lengthbigintAverage number of read requests that were queued for the selected disk during the sample intervalavg_disk_write_queue_lengthbigintAverage number of write requests that were queued for the selected disk during the sample intervalavg_disk_sec_per_readintegerAverage time, in seconds, of a read operation of data from the diskavg_disk_sec_per_writeintegerAverage time, in seconds, of a write operation of data to the diskcurrent_disk_queue_lengthintegerNumber of requests outstanding on the disk at the time the performance data is collectedpercent_disk_read_timebigintPercentage of elapsed time that the selected disk drive is busy servicing read requestspercent_disk_write_timebigintPercentage of elapsed time that the selected disk drive is busy servicing write requestspercent_disk_timebigintPercentage of elapsed time that the selected disk drive is busy servicing read or write requestspercent_idle_timebigintPercentage of time during the sample interval that the disk was idleCOLUMNTYPEDESCRIPTIONpidbigintProcess ID of the process to which the pipe belongsnametextName of the pipeinstancesintegerNumber of instances of the named pipemax_instancesintegerThe maximum number of instances creatable for this pipeflagstextThe flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytesCOLUMNTYPEDESCRIPTIONnametextPackage nameversiontextPackage versionflatsizebigintPackage size in bytesarchtextArchitecture(s) supportedCOLUMNTYPEDESCRIPTIONvendortextPlatform code vendorversiontextPlatform code versiondatetextSelf-reported platform code update daterevisiontextBIOS major and minor revisionaddresstextRelative address of firmware mappingsizetextSize in bytes of firmwarevolume_sizeinteger(Optional) size of firmware volumeextratextPlatform-specific additional informationCOLUMNTYPEDESCRIPTIONkeytextPreference top-level keysubkeytextIntermediate key path, includes lists/dictsvaluetextString value of most CF typespathtext(required) read preferences from a plistCOLUMNTYPEDESCRIPTIONpackagetextPackage nameversiontextThe version which are affected by the use flags, empty means allkeywordtextThe keyword applied to the packagemaskintegerIf the package is maskedunmaskintegerIf the package is unmaskedCOLUMNTYPEDESCRIPTIONpackagetextPackage nameversiontextThe version which are affected by the use flags, empty means allslottextThe slot used by packagebuild_timebigintUnix time when package was builtrepositorytextFrom which repository the ebuild was usedeapibigintThe eapi for the ebuildsizebigintThe size of the packageworldintegerIf package is in the world fileCOLUMNTYPEDESCRIPTIONpackagetextPackage nameversiontextThe version of the installed packageusetextUSE flag which has been enabled for packageCOLUMNTYPEDESCRIPTIONkeytextThe SMC key on OS XcategorytextThe sensor category: currents, voltage, wattagenametextName of power sourcevaluetextPower in WattsCOLUMNTYPEDESCRIPTIONtimebigintTimestamp the event was received by the osquery event publisherdatetimetextSystem time at which the Powershell script event occurredscript_block_idtextThe unique GUID of the powershell script to which this block belongsscript_block_countintegerThe total number of script blocks for this scriptscript_texttextThe text content of the Powershell scriptscript_nametextThe name of the Powershell scriptscript_pathtextThe path for the Powershell scriptcosine_similaritydoubleHow similar the Powershell script is to a provided 'normal' character frequencyCOLUMNTYPEDESCRIPTIONdomaintextApplication ID usually in com.name.product formatkeytextPreference top-level keysubkeytextIntemediate key path, includes lists/dictsvaluetextString value of most CF typesforcedinteger1 if the value is forced/managed, else 0usernametext(optional) read preferences for a specific userhosttext'current' or 'any' host, where 'current' takes precedenceCOLUMNTYPEDESCRIPTIONpathtextPrefetch file path.filenametextExecutable filename.hashtextPrefetch CRC hash.last_run_timeintegerMost recent time application was run.other_run_timestextOther execution times in prefetch file.run_countintegerNumber of times the application has been run.sizeintegerApplication file size.volume_serialtextVolume serial number.volume_creationtextVolume creation time.accessed_files_countintegerNumber of files accessed.accessed_directories_countintegerNumber of directories accessed.accessed_filestextFiles accessed by application within ten seconds of launch.accessed_directoriestextDirectories accessed by application within ten seconds of launch.COLUMNTYPEDESCRIPTIONpidintegerProcess (or thread) IDkeytextEnvironment variable namevaluetextEnvironment variable valueCOLUMNTYPEDESCRIPTIONpidbigintProcess (or thread) IDpathtextPath of executed filemodetextFile mode permissionscmdlinetextCommand line arguments (argv)cmdline_sizebigintActual size (bytes) of command line argumentsenvtextEnvironment variables delimited by spacesenv_countbigintNumber of environment variablesenv_sizebigintActual size (bytes) of environment listcwdtextThe process current working directoryauidbigintAudit User ID at process startuidbigintUser ID at process starteuidbigintEffective user ID at process startgidbigintGroup ID at process startegidbigintEffective group ID at process startowner_uidbigintFile owner user IDowner_gidbigintFile owner group IDatimebigintFile last access in UNIX timemtimebigintFile modification in UNIX timectimebigintFile last metadata change in UNIX timebtimebigintFile creation in UNIX timeoverflowstextList of structures that overflowedparentbigintProcess parent's PID, or -1 if cannot be determined.timebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeeidtextEvent IDstatusbigintOpenBSM Attribute: Status of the processfsuidbigintFilesystem user ID at process startsuidbigintSaved user ID at process startfsgidbigintFilesystem group ID at process startsgidbigintSaved group ID at process startsyscalltextSyscall name: fork, vfork, clone, execve, execveatCOLUMNTYPEDESCRIPTIONoperationtextOperation typepidbigintProcess IDppidbigintParent process IDtimebigintTime of execution in UNIX timeexecutabletextThe executable pathpartialtextTrue if this is a partial event (i.e.: this process existed before we started osquery)cwdtextThe current working directory of the processpathtextThe path associated with the eventdest_pathtextThe canonical path associated with the eventuidtextThe uid of the process performing the actiongidtextThe gid of the process performing the actionauidtextAudit user ID of the process using the fileeuidtextEffective user ID of the process using the fileegidtextEffective group ID of the process using the filefsuidtextFilesystem user ID of the process using the filefsgidtextFilesystem group ID of the process using the filesuidtextSaved user ID of the process using the filesgidtextSaved group ID of the process using the fileuptimebigintTime of execution in system uptimeeidtextEvent IDCOLUMNTYPEDESCRIPTIONpidintegerProcess (or thread) IDstarttextVirtual start address (hex)endtextVirtual end address (hex)permissionstextr=read, w=write, x=execute, p=private (cow)offsetbigintOffset into mapped pathdevicetextMA:MI Major/minor device IDinodeintegerMapped path inode, 0 means uninitialized (BSS)pathtextPath to mapped file or mapped typepseudointeger1 If path is a pseudo path, else 0COLUMNTYPEDESCRIPTIONpidintegerProcess (or thread) IDcgroup_namespacetextcgroup namespace inodeipc_namespacetextipc namespace inodemnt_namespacetextmnt namespace inodenet_namespacetextnet namespace inodepid_namespacetextpid namespace inodeuser_namespacetextuser namespace inodeuts_namespacetextuts namespace inodeCOLUMNTYPEDESCRIPTIONpidbigintProcess (or thread) IDfdbigintProcess-specific file descriptor numberpathtextFilesystem path of descriptorCOLUMNTYPEDESCRIPTIONpidbigintProcess IDfdbigintFile descriptormodetextPipe open mode (r/w)inodebigintPipe inode numbertypetextPipe Type: named vs unnamed/anonymouspartner_pidbigintProcess ID of partner process sharing a particular pipepartner_fdbigintFile descriptor of shared pipe at partner's endpartner_modetextMode of shared pipe at partner's endCOLUMNTYPEDESCRIPTIONpidintegerProcess (or thread) IDfdbigintSocket file descriptor numbersocketbigintSocket handle or inode numberfamilyintegerNetwork protocol (IPv4, IPv6)protocolintegerTransport protocol (TCP/UDP)local_addresstextSocket local addressremote_addresstextSocket remote addresslocal_portintegerSocket local portremote_portintegerSocket remote portpathtextFor UNIX sockets (family=AF_UNIX), the domain pathstatetextTCP socket statenet_namespacetextThe inode number of the network namespaceCOLUMNTYPEDESCRIPTIONpidbigintProcess (or thread) IDnametextThe process path or shorthand argv[0]pathtextPath to executed binarycmdlinetextComplete argvstatetextProcess statecwdtextProcess current working directoryroottextProcess virtual root directoryuidbigintUnsigned user IDgidbigintUnsigned group IDeuidbigintUnsigned effective user IDegidbigintUnsigned effective group IDsuidbigintUnsigned saved user IDsgidbigintUnsigned saved group IDon_diskintegerThe process path exists yes=1, no=0, unknown=-1wired_sizebigintBytes of unpageable memory used by processresident_sizebigintBytes of private memory used by processtotal_sizebigintTotal virtual memory sizeuser_timebigintCPU time in milliseconds spent in user spacesystem_timebigintCPU time in milliseconds spent in kernel spacedisk_bytes_readbigintBytes read from diskdisk_bytes_writtenbigintBytes written to diskstart_timebigintProcess start time in seconds since Epoch, in case of error -1parentbigintProcess parent's PIDpgroupbigintProcess groupthreadsintegerNumber of threads used by processniceintegerProcess nice level (-20 to 20, default 0)elevated_tokenintegerProcess uses elevated token yes=1, no=0secure_processintegerProcess is secure (IUM) yes=1, no=0protection_typetextThe protection type of the processvirtual_processintegerProcess is virtual (e.g. System, Registry, vmmem) yes=1, no=0elapsed_timebigintElapsed time in seconds this process has been running.handle_countbigintTotal number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.percent_processor_timebigintReturns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.upidbigintA 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system.uppidbigintThe 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system.cpu_typeintegerIndicates the specific processor designed for installation.cpu_subtypeintegerIndicates the specific processor on which an entry may be used.COLUMNTYPEDESCRIPTIONnametextCommonly used product name.versiontextProduct version information.install_locationtextThe installation location directory of the product.install_sourcetextThe installation source of the product.languagetextThe language of the product.publishertextName of the product supplier.uninstall_stringtextPath and filename of the uninstaller.install_datetextDate that this product was installed on the system. identifying_numbertextProduct identification such as a serial number on software, or a die number on a hardware chip.COLUMNTYPEDESCRIPTIONtarget_nametextAddress of prometheus targetmetric_nametextName of collected Prometheus metricmetric_valuedoubleValue of collected Prometheus metrictimestamp_msbigintUnix timestamp of collected data in MSCOLUMNTYPEDESCRIPTIONnametextPackage display nameversiontextPackage-supplied versionsummarytextPackage-supplied summaryauthortextOptional package authorlicensetextLicense under which package is launchedpathtextPath at which this module residesdirectorytextDirectory where Python modules are locatedpid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONpathtextPath of filerowidintegerQuicklook file rowid keyfs_idtextQuicklook file fs_id keyvolume_idintegerParsed volume ID from fs_idinodeintegerParsed file ID (inode) from fs_idmtimeintegerParsed version date fieldsizebigintParsed version size fieldlabeltextParsed version 'gen' fieldlast_hit_dateintegerApple date format for last thumbnail cache hithit_counttextNumber of cache hits on thumbnailicon_modebigintThumbnail icon modecache_pathtextPath to cache dataCOLUMNTYPEDESCRIPTIONkeytextName of the key to search forpathtextFull path to the valuenametextName of the registry value entrytypetextType of the registry value, or 'subkey' if item is a subkeydatatextData content of registry valuemtimebiginttimestamp of the most recent registry writeCOLUMNTYPEDESCRIPTIONdestinationtextDestination IP addressnetmaskintegerNetmask lengthgatewaytextRoute gatewaysourcetextRoute sourceflagsintegerFlags to describe routeinterfacetextRoute local interfacemtuintegerMaximum Transmission Unit for the routemetricintegerCost of route. Lowest is preferredtypetextType of routehopcountintegerMax hops expectedCOLUMNTYPEDESCRIPTIONpackagetextRPM package namepathtextFile path within the packageusernametextFile default username from info DBgroupnametextFile default groupname from info DBmodetextFile permissions mode from info DBsizebigintExpected file size in bytes from RPM info DBsha256textSHA256 file digest from RPM info DBCOLUMNTYPEDESCRIPTIONnametextRPM package nameversiontextPackage versionreleasetextPackage releasesourcetextSource RPM package name (optional)sizebigintPackage size in bytessha1textSHA1 hash of the package contentsarchtextArchitecture(s) supportedepochintegerPackage epoch valueinstall_timeintegerWhen the package was installedvendortextPackage vendorpackage_grouptextPackage grouppid_with_namespaceintegerPids that contain a namespacemount_namespace_idtextMount namespace idCOLUMNTYPEDESCRIPTIONpidintegerThe pid of the applicationbundle_identifiertextThe bundle identifier of the applicationis_activeinteger1 if the application is in focus, 0 otherwiseCOLUMNTYPEDESCRIPTIONuidbigintThe local user that owns the extensionnametextExtension display nameidentifiertextExtension identifierversiontextExtension long versionsdktextBundle SDK used to compile extensionupdate_urltextExtension-supplied update URIauthortextOptional extension authordeveloper_idtextOptional developer identifierdescriptiontextOptional extension description textpathtextPath to extension XAR bundleCOLUMNTYPEDESCRIPTIONlabeltextUTI-format bundle or label IDusertextSandbox ownerenabledintegerApplication sandboxings enabled on containerbuild_idtextSandbox-specific identifierbundle_pathtextApplication bundle used by the sandboxpathtextPath to sandbox container directoryCOLUMNTYPEDESCRIPTIONnametextName of the scheduled taskactiontextActions executed by the scheduled taskpathtextPath to the executable to be runenabledintegerWhether or not the scheduled task is enabledstatetextState of the scheduled taskhiddenintegerWhether or not the task is visible in the UIlast_run_timebigintTimestamp the task last rannext_run_timebigintTimestamp the task is scheduled to run nextlast_run_messagetextExit status message of the last task runlast_run_codetextExit status code of the last task runCOLUMNTYPEDESCRIPTIONenabledinteger1 If a password is required after sleep or the screensaver begins; else 0grace_periodintegerThe amount of time in seconds the screen must be asleep or the screensaver on before a password is required on-wake. 0 = immediately; -1 = no password is required on-wakeCOLUMNTYPEDESCRIPTIONtimebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeauidunsigned_bigintAudit user ID (loginuid) of the user who started the analyzed processuidunsigned_bigintUser ID of the user who started the analyzed processgidunsigned_bigintGroup ID of the user who started the analyzed processsesunsigned_bigintSession ID of the session from which the analyzed process was invokedpidunsigned_bigintProcess IDcommtextCommand-line name of the command that was used to invoke the analyzed processexetextThe path to the executable that was used to invoke the analyzed processsigbigintSignal value sent to process by seccomparchtextInformation about the CPU architecturesyscalltextType of the system callcompatbigintIs system call in compatibility modeiptextInstruction pointer valuecodetextThe seccomp actionCOLUMNTYPEDESCRIPTIONsecure_bootintegerWhether secure boot is enabledsetup_modeintegerWhether setup mode is enabledCOLUMNTYPEDESCRIPTIONtypetextEvent typemessagetextMessagetimebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeeidtextEvent IDCOLUMNTYPEDESCRIPTIONscopetextWhere the key is located inside the SELinuxFS mount point.keytextKey or class name.valuetextActive value.COLUMNTYPEDESCRIPTIONnametextService nameservice_typetextService Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)display_nametextService Display namestatustextService Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSEDpidintegerthe Process ID of the servicestart_typetextService start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLEDwin32_exit_codeintegerThe error code that the service uses to report an error that occurs when it is starting or stoppingservice_exit_codeintegerThe service-specific error code that the service returns when an error occurs while the service is starting or stoppingpathtextPath to Service Executablemodule_pathtextPath to ServiceDlldescriptiontextService Descriptionuser_accounttextThe name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\UserName. If the account belongs to the built-in domain, the name can be of the form .\UserName.COLUMNTYPEDESCRIPTIONpassword_statustextPassword statushash_algtextPassword hashing algorithmlast_changebigintDate of last password change (starting from UNIX epoch date)minbigintMinimal number of days between password changesmaxbigintMaximum number of days between password changeswarningbigintNumber of days before password expires to warn user about itinactivebigintNumber of days after password expires until account is blockedexpirebigintNumber of days since UNIX epoch date until account is disabledflagbigintReservedusernametextUsernameCOLUMNTYPEDESCRIPTIONnametextThe shared name of the folder as it appears to other userspathtextAbsolute path of shared folder on the local systemCOLUMNTYPEDESCRIPTIONshmidintegerShared memory segment IDowner_uidbigintUser ID of owning processcreator_uidbigintUser ID of creator processpidbigintProcess ID to last use the segmentcreator_pidbigintProcess ID that created the segmentatimebigintAttached timedtimebigintDetached timectimebigintChanged timepermissionstextMemory segment permissionssizebigintSize in bytesattachedintegerNumber of attached processesstatustextDestination/attach statuslockedinteger1 if segment is locked else 0COLUMNTYPEDESCRIPTIONdescriptiontextA textual description of the objectinstall_datetextIndicates when the object was installed. Lack of a value does not indicate that the object is not installed.statustextString that indicates the current status of the object.allow_maximumintegerNumber of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.maximum_allowedintegerLimit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.nametextAlias given to a path set up as a share on a computer system running Windows.pathtextLocal path of the Windows share.typeintegerType of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.COLUMNTYPEDESCRIPTIONscreen_sharinginteger1 If screen sharing is enabled else 0file_sharinginteger1 If file sharing is enabled else 0printer_sharinginteger1 If printer sharing is enabled else 0remote_logininteger1 If remote login is enabled else 0remote_managementinteger1 If remote management is enabled else 0remote_apple_eventsinteger1 If remote apple events are enabled else 0internet_sharinginteger1 If internet sharing is enabled else 0bluetooth_sharinginteger1 If bluetooth sharing is enabled for any user else 0disc_sharinginteger1 If CD or DVD sharing is enabled else 0content_cachinginteger1 If content caching is enabled else 0COLUMNTYPEDESCRIPTIONuidbigintShell history ownertimeintegerEntry timestamp. It could be absent, default value is 0.commandtextUnparsed date/line/command history linehistory_filetextPath to the .*_history for this userCOLUMNTYPEDESCRIPTIONsidtextUser SIDsourcetextShellbags source Registry filepathtextDirectory name.modified_timebigintDirectory Modified time.created_timebigintDirectory Created time.accessed_timebigintDirectory Accessed time.mft_entrybigintDirectory master file table entry.mft_sequenceintegerDirectory master file table sequence.COLUMNTYPEDESCRIPTIONentryintegerExecution order.pathtextThis is the path to the executed file.modified_timeintegerFile Modified time.execution_flagintegerBoolean Execution flag, 1 for execution, 0 for no execution, -1 for missing (this flag does not exist on Windows 10 and higher).COLUMNTYPEDESCRIPTIONpathtextDirectory name.target_pathtextTarget file pathtarget_modifiedintegerTarget Modified time.target_createdintegerTarget Created time.target_accessedintegerTarget Accessed time.target_sizebigintSize of target file.relative_pathtextRelative path to target file from lnk file.local_pathtextLocal system path to target file.working_pathtextTarget file directory.icon_pathtextLnk file icon location.common_pathtextCommon system path to target file.command_argstextCommand args passed to lnk file.hostnametextOptional hostname of the target file.share_nametextShare name of the target file.device_typetextDevice containing the target file.volume_serialtextVolume serial number.mft_entrybigintTarget mft entry.mft_sequenceintegerTarget mft sequence.descriptiontextLnk file description.COLUMNTYPEDESCRIPTIONpathtextMust provide a path or directoryhash_resourcesintegerSet to 1 to also hash resources, or 0 otherwise. Default is 1archtextIf applicable, the arch of the signed codesignedinteger1 If the file is signed else 0identifiertextThe signing identifier sealed into the signaturecdhashtextHash of the application Code Directoryteam_identifiertextThe team signing identifier sealed into the signatureauthoritytextCertificate Common NameCOLUMNTYPEDESCRIPTIONconfig_flagtextThe System Integrity Protection config flagenabledinteger1 if this configuration is enabled, otherwise 0enabled_nvraminteger1 if this configuration is enabled, otherwise 0COLUMNTYPEDESCRIPTIONdevice_nametextName of block devicedisk_idintegerPhysical slot number of device, only exists when hardware storage controller existsdriver_typetextThe explicit device type used to retrieve the SMART informationmodel_familytextDrive model familydevice_modeltextDevice Modelserial_numbertextDevice serial numberlu_wwn_device_idtextDevice Identifieradditional_product_idtextAn additional drive identifier if anyfirmware_versiontextDrive firmware versionuser_capacitytextBytes of drive capacitysector_sizestextBytes of drive sector sizesrotation_ratetextDrive RPMform_factortextForm factor if reportedin_smartctl_dbintegerBoolean value for if drive is recognizedata_versiontextATA version of drivetransport_typetextDrive transport typesata_versiontextSATA version, if anyread_device_identity_failuretextError string for device id read, if anysmart_supportedtextSMART support statussmart_enabledtextSMART enabled statuspacket_device_typetextPacket device typepower_modetextDevice power modewarningstextWarning messages from SMART controllerCOLUMNTYPEDESCRIPTIONnumberintegerTable entry numbertypeintegerTable entry typedescriptiontextTable entry descriptionhandleintegerTable entry handleheader_sizeintegerHeader size in bytessizeintegerTable entry size in bytesmd5textMD5 hash of table entryCOLUMNTYPEDESCRIPTIONkeytext4-character keytypetextSMC-reported type literal typesizeintegerReported size of data in bytesvaluetextA type-encoded representation of the key valuehiddeninteger1 if this key is normally hidden, otherwise 0COLUMNTYPEDESCRIPTIONactiontextThe socket action (bind, listen, close)pidbigintProcess (or thread) IDpathtextPath of executed filefdtextThe file description for the process socketauidbigintAudit User IDstatustextEither 'succeeded', 'failed', 'in_progress' (connect() on non-blocking socket) or 'no_client' (null accept() on non-blocking socket)familyintegerThe Internet protocol family IDprotocolintegerThe network protocol IDlocal_addresstextLocal address associated with socketremote_addresstextRemote address associated with socketlocal_portintegerLocal network protocol port numberremote_portintegerRemote network protocol port numbersockettextThe local path (UNIX domain socket only)timebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeeidtextEvent IDsuccessintegerDeprecated. Use the 'status' column insteadCOLUMNTYPEDESCRIPTIONuidbigintThe local owner of the ssh_config fileblocktextThe host or match blockoptiontextThe option and valuessh_config_filetextPath to the ssh_config fileCOLUMNTYPEDESCRIPTIONnametextName of startup itempathtextPath of startup itemargstextArguments provided to startup executabletypetextStartup Item or Login ItemsourcetextDirectory or plist containing startup itemstatustextStartup status; either enabled or disabledusernametextThe user associated with the startup itemCOLUMNTYPEDESCRIPTIONsourcetextSource file containing the given ruleheadertextSymbol for given rulerule_detailstextRule definitionCOLUMNTYPEDESCRIPTIONpathtextBinary pathusernametextBinary owner usernamegroupnametextBinary owner grouppermissionstextBinary permissionspid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONtimebigintCurrent unix epoch timedatetimetextTime known to sysloghosttextHostname configured for syslogseverityintegerSyslog severityfacilitytextSyslog facilitytagtextThe syslog tagmessagetextThe syslog messageeidtextEvent IDCOLUMNTYPEDESCRIPTIONnametextFull sysctl MIB nameoidtextControl MIBsubsystemtextSubsystem ID, control typecurrent_valuetextValue of settingconfig_valuetextThe MIB value set in /etc/sysctl.conftypetextData typefield_nametextSpecific attribute of opaque typeCOLUMNTYPEDESCRIPTIONpathtextOriginal path of system extensionUUIDtextExtension unique idstatetextSystem extension stateidentifiertextIdentifier nameversiontextSystem extension versioncategorytextSystem extension categorybundle_pathtextSystem extension bundle pathteamtextSigning team IDmdm_managedinteger1 if managed by MDM system extension payload configuration, 0 otherwiseCOLUMNTYPEDESCRIPTIONhostnametextNetwork hostname including domainuuidtextUnique ID provided by the systemcpu_typetextCPU typecpu_subtypetextCPU subtypecpu_brandtextCPU brand string, contains vendor and modelcpu_physical_coresintegerNumber of physical CPU cores in to the systemcpu_logical_coresintegerNumber of logical CPU cores available to the systemcpu_microcodetextMicrocode versionphysical_memorybigintTotal physical memory in byteshardware_vendortextHardware vendorhardware_modeltextHardware modelhardware_versiontextHardware versionhardware_serialtextDevice serial numberboard_vendortextBoard vendorboard_modeltextBoard modelboard_versiontextBoard versionboard_serialtextBoard serial numbercomputer_nametextFriendly computer name (optional)local_hostnametextLocal hostname (optional)COLUMNTYPEDESCRIPTIONidtextUnique unit identifierdescriptiontextUnit descriptionload_statetextReflects whether the unit definition was properly loadedactive_statetextThe high-level unit activation state, i.e. generalization of SUBsub_statetextThe low-level unit activation state, values depend on unit typefollowingtextThe name of another unit that this unit follows in stateobject_pathtextThe object path for this unitjob_idbigintNext queued job idjob_typetextJob typejob_pathtextThe object path for the jobfragment_pathtextThe unit file path this unit was read from, if there is anyusertextThe configured user, if anysource_pathtextPath to the (possibly generated) unit configuration fileCOLUMNTYPEDESCRIPTIONkeytextThe SMC key on OS XnametextName of temperature sourcecelsiusdoubleTemperature in CelsiusfahrenheitdoubleTemperature in FahrenheitCOLUMNTYPEDESCRIPTIONweekdaytextCurrent weekday in the systemyearintegerCurrent year in the systemmonthintegerCurrent month in the systemdayintegerCurrent day in the systemhourintegerCurrent hour in the systemminutesintegerCurrent minutes in the systemsecondsintegerCurrent seconds in the systemtimezonetextCurrent timezone in the systemlocal_timeintegerCurrent local UNIX time in the systemlocal_timezonetextCurrent local timezone in the systemunix_timeintegerCurrent UNIX time in the system, converted to UTC if --utc enabledtimestamptextCurrent timestamp (log format) in the systemdatetimetextCurrent date and time (ISO format) in the systemiso_8601textCurrent time (ISO format) in the systemwin_timestampbigintTimestamp value in 100 nanosecond units.COLUMNTYPEDESCRIPTIONdestination_idtextTime Machine destination IDbackup_dateintegerBackup DateCOLUMNTYPEDESCRIPTIONaliastextHuman readable name of drivedestination_idtextTime Machine destination IDconsistency_scan_dateintegerConsistency scan dateroot_volume_uuidtextRoot UUID of backup volumebytes_availableintegerBytes available on volumebytes_usedintegerBytes used on volumeencryptiontextLast known encrypted stateCOLUMNTYPEDESCRIPTIONactivatedintegerTPM is activatedenabledintegerTPM is enabledownedintegerTPM is ownnedmanufacturer_versiontextTPM versionmanufacturer_idintegerTPM manufacturers IDmanufacturer_nametextTPM manufacturers nameproduct_nametextProduct name of the TPMphysical_presence_versiontextVersion of the Physical Presence Interfacespec_versiontextTrusted Computing Group specification that the TPM supportsCOLUMNTYPEDESCRIPTIONtypetextSystem resource to be limitedsoft_limittextCurrent limit valuehard_limittextMaximum limit valueCOLUMNTYPEDESCRIPTIONdaysintegerDays of uptimehoursintegerHours of uptimeminutesintegerMinutes of uptimesecondsintegerSeconds of uptimetotal_secondsbigintTotal uptime secondsCOLUMNTYPEDESCRIPTIONusb_addressintegerUSB Device used addressusb_portintegerUSB Device used portvendortextUSB Device vendor stringvendor_idtextHex encoded USB Device vendor identifierversiontextUSB Device version numbermodeltextUSB Device model stringmodel_idtextHex encoded USB Device model identifierserialtextUSB Device serial connectionclasstextUSB Device classsubclasstextUSB Device subclassprotocoltextUSB Device protocolremovableinteger1 If USB device is removable else 0COLUMNTYPEDESCRIPTIONuidbigintUser IDauidbigintAudit User IDpidbigintProcess (or thread) IDmessagetextMessage from the eventtypeintegerThe file description for the process socketpathtextSupplied path from eventaddresstextThe Internet protocol address or family IDterminaltextThe network protocol IDtimebigintTime of execution in UNIX timeuptimebigintTime of execution in system uptimeeidtextEvent IDCOLUMNTYPEDESCRIPTIONuidbigintUser IDgidbigintGroup IDCOLUMNTYPEDESCRIPTIONtimebigintTimeCOLUMNTYPEDESCRIPTIONuidbigintThe local user that owns the key filepathtextPath to key fileencryptedinteger1 if key is encrypted, 0 otherwisekey_typetextThe type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.pid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONpathtextApplication file path.last_execution_timebigintMost recent time application was executed.countintegerNumber of times the application has been executed.sidtextUser SID.COLUMNTYPEDESCRIPTIONuidbigintUser IDgidbigintGroup ID (unsigned)uid_signedbigintUser ID as int64 signed (Apple)gid_signedbigintDefault group ID as int64 signed (Apple)usernametextUsernamedescriptiontextOptional user descriptiondirectorytextUser's home directoryshelltextUser's configured default shelluuidtextUser's UUID (Apple) or SID (Windows)typetextWhether the account is roaming (domain), local, or a system profileis_hiddenintegerIsHidden attribute set in OpenDirectorypid_with_namespaceintegerPids that contain a namespaceCOLUMNTYPEDESCRIPTIONcolor_depthintegerThe amount of bits per pixel to represent color.drivertextThe driver of the device.driver_datebigintThe date listed on the installed driver.driver_versiontextThe version of the installed driver.manufacturertextThe manufacturer of the gpu.modeltextThe model of the gpu.seriestextThe series of the gpu.video_modetextThe current resolution of the display.COLUMNTYPEDESCRIPTIONfreebigintTotal number of free pages.activebigintTotal number of active pages.inactivebigintTotal number of inactive pages.speculativebigintTotal number of speculative pages.throttledbigintTotal number of throttled pages.wiredbigintTotal number of wired down pages.purgeablebigintTotal number of purgeable pages.faultsbigintTotal number of calls to vm_faults.copybigintTotal number of copy-on-write pages.zero_fillbigintTotal number of zero filled pages.reactivatedbigintTotal number of reactivated pages.purgedbigintTotal number of purged pages.file_backedbigintTotal number of file backed pages.anonymousbigintTotal number of anonymous pages.uncompressedbigintTotal number of uncompressed pages.compressorbigintThe number of pages used to store compressed VM pages.decompressedbigintThe total number of pages that have been decompressed by the VM compressor.compressedbigintThe total number of pages that have been compressed by the VM compressor.page_insbigintThe total number of requests for pages from a pager.page_outsbigintTotal number of pages paged out.swap_insbigintThe total number of compressed pages that have been swapped out to disk.swap_outsbigintThe total number of compressed pages that have been swapped back in from disk.COLUMNTYPEDESCRIPTIONssidtextSSID octets of the networknetwork_nametextName of the networksecurity_typetextType of security on this networklast_connectedintegerLast time this netword was connected to as a unix_timepasspointinteger1 if Passpoint is supported, 0 otherwisepossibly_hiddeninteger1 if network is possibly a hidden network, 0 otherwiseroaminginteger1 if roaming is supported, 0 otherwiseroaming_profiletextDescribe the roaming profile, usually one of Single, Dual or Multicaptive_portalinteger1 if this network has a captive portal, 0 otherwiseauto_logininteger1 if auto login is enabled, 0 otherwisetemporarily_disabledinteger1 if this network is temporarily disabled, 0 otherwisedisabledinteger1 if this network is disabled, 0 otherwiseCOLUMNTYPEDESCRIPTIONinterfacetextName of the interfacessidtextSSID octets of the networkbssidtextThe current basic service set identifiernetwork_nametextName of the networkcountry_codetextThe country code (ISO/IEC 3166-1:1997) for the networksecurity_typetextType of security on this networkrssiintegerThe current received signal strength indication (dbm)noiseintegerThe current noise measurement (dBm)channelintegerChannel numberchannel_widthintegerChannel widthchannel_bandintegerChannel bandtransmit_ratetextThe current transmit ratemodetextThe current operating mode for the Wi-Fi interfaceCOLUMNTYPEDESCRIPTIONinterfacetextName of the interfacessidtextSSID octets of the networkbssidtextThe current basic service set identifiernetwork_nametextName of the networkcountry_codetextThe country code (ISO/IEC 3166-1:1997) for the networkrssiintegerThe current received signal strength indication (dbm)noiseintegerThe current noise measurement (dBm)channelintegerChannel numberchannel_widthintegerChannel widthchannel_bandintegerChannel bandCOLUMNTYPEDESCRIPTIONsession_idintegerTerminal Services Session Idobject_nametextObject Nameobject_typetextObject TypeCOLUMNTYPEDESCRIPTIONdatetimetextTimestamp (log format) of the crashmoduletextPath of the crashed module within the processpathtextPath of the executable file for the crashed processpidbigintProcess ID of the crashed processtidbigintThread ID of the crashed threadversiontextFile version info of the crashed processprocess_uptimebigintUptime of the process in secondsstack_tracetextMultiple stack frames from the stack traceexception_codetextThe Windows exception codeexception_messagetextThe NTSTATUS error message associated with the exception codeexception_addresstextAddress (in hex) where the exception occurredregisterstextThe values of the system registerscommand_linetextCommand-line string passed to the crashed processcurrent_directorytextCurrent working directory of the crashed processusernametextUsername of the user who ran the crashed processmachine_nametextName of the machine where the crash happenedmajor_versionintegerWindows major version of the machineminor_versionintegerWindows minor version of the machinebuild_numberintegerWindows build number of the crashing machinetypetextType of crash logcrash_pathtextPath of the log fileCOLUMNTYPEDESCRIPTIONchanneltextSource or channel of the eventdatetimetextSystem time at which the event occurredtaskintegerTask value associated with the eventlevelintegerSeverity level associated with the eventprovider_nametextProvider name of the eventprovider_guidtextProvider guid of the eventcomputer_nametextHostname of system where event was generatedeventidintegerEvent ID of the eventkeywordstextA bitmask of the keywords defined in the eventdatatextData associated with the eventpidintegerProcess ID which emitted the event recordtidintegerThread ID which emitted the event recordtime_rangetextSystem time to selectively filter the eventstimestamptextTimestamp to selectively filter the eventsxpathtextThe custom query to filter eventsCOLUMNTYPEDESCRIPTIONtimebigintTimestamp the event was receiveddatetimetextSystem time at which the event occurredsourcetextSource or channel of the eventprovider_nametextProvider name of the eventprovider_guidtextProvider guid of the eventcomputer_nametextHostname of system where event was generatedeventidintegerEvent ID of the eventtaskintegerTask value associated with the eventlevelintegerThe severity level associated with the eventkeywordstextA bitmask of the keywords defined in the eventdatatextData associated with the eventeidtextEvent IDCOLUMNTYPEDESCRIPTIONnametextName of the featurecaptiontextCaption of feature in settings UIstateintegerInstallation state value. 1 == Enabled, 2 == Disabled, 3 == AbsentstatenametextInstallation state name. 'Enabled','Disabled','Absent'COLUMNTYPEDESCRIPTIONfirewalltextThe health of the monitored Firewall (see windows_security_products)autoupdatetextThe health of the Windows Autoupdate featureantivirustextThe health of the monitored Antivirus solution (see windows_security_products)antispywaretextThe health of the monitored Antispyware solution (see windows_security_products)internet_settingstextThe health of the Internet Settingswindows_security_center_servicetextThe health of the Windows Security Center Serviceuser_account_controltextThe health of the User Account Control (UAC) capability in WindowsCOLUMNTYPEDESCRIPTIONtypetextType of security productnametextName of productstatetextState of protectionstate_timestamptextTimestamp for the product stateremediation_pathtextRemediation pathsignatures_up_to_dateinteger1 if product signatures are up to date, else 0COLUMNTYPEDESCRIPTIONnametextName of the Bios settingvaluetextValue of the Bios settingCOLUMNTYPEDESCRIPTIONnametextUnique name of a consumer.command_line_templatetextStandard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.executable_pathtextModule to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.classtextThe name of the class.relative_pathtextRelative path to the class or instance.COLUMNTYPEDESCRIPTIONnametextUnique identifier of an event filter.querytextWindows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.query_languagetextQuery language that the query is written in.classtextThe name of the class.relative_pathtextRelative path to the class or instance.COLUMNTYPEDESCRIPTIONconsumertextReference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.filtertextReference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.classtextThe name of the class.relative_pathtextRelative path to the class or instance.COLUMNTYPEDESCRIPTIONnametextUnique identifier for the event consumer. scripting_enginetextName of the scripting engine to use, for example, 'VBScript'. This property cannot be NULL.script_file_nametextName of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.script_texttextText of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.classtextThe name of the class.relative_pathtextRelative path to the class or instance.COLUMNTYPEDESCRIPTIONnametextDescription of XProtected malwarelaunch_typetextLaunch services content typeidentitytextXProtect identity (SHA1) of contentfilenametextUse this file name to matchfiletypetextUse this file type to matchoptionalintegerMatch any of the identities/patterns for this XProtect nameuses_patternintegerUses a match pattern instead of identityCOLUMNTYPEDESCRIPTIONidentifiertextBrowser plugin or extension identifiertypetextEither plugin or extensiondeveloper_idtextDeveloper identity (SHA1) of extensionmin_versiontextThe minimum allowed plugin version.COLUMNTYPEDESCRIPTIONnametextDescription of XProtected malwareuser_actiontextAction taken by user after promptedtimetextQuarantine alert timeCOLUMNTYPEDESCRIPTIONpathtextThe path scannedmatchestextList of YARA matchescountintegerNumber of YARA matchessig_grouptextSignature group usedsigfiletextSignature file usedsigruletextSignature strings usedstringstextMatching stringstagstextMatching tagssigurltextSignature urlCOLUMNTYPEDESCRIPTIONtarget_pathtextThe path scannedcategorytextThe category of the fileactiontextChange action (UPDATE, REMOVE, etc)transaction_idbigintID used during bulk updatematchestextList of YARA matchescountintegerNumber of YARA matchesstringstextMatching stringstagstextMatching tagstimebigintTime of the scaneidtextEvent IDCOLUMNTYPEDESCRIPTIONinstance_idtextUnique identifier for the VMfolder_idtextFolder identifier for the VMnametextName of the VMdescriptiontextDescription of the VMhostnametextHostname of the VMzonetextAvailability zone of the VMssh_public_keytextSSH public key. Only available if supplied at instance launch timeserial_port_enabledtextIndicates if serial port is enabled for the VMmetadata_endpointtextEndpoint used to fetch VM metadataCOLUMNTYPEDESCRIPTIONnametextRepository namebaseurltextRepository base URLenabledtextWhether the repository is usedgpgchecktextWhether packages are GPG checkedgpgkeytextURL to GPG keypid_with_namespaceintegerPids that contain a namespace
Osquery Version:
5.0.1(current)
Show only Tables compatible with:
account_policy_data
Additional OS X user account data from the AccountPolicy section of OpenDirectory.
Improve this Description on Githubapple
acpi_tables
Firmware ACPI functional table common metadata and content.
Improve this Description on Githubapplelinux
apple
OS X application layer firewall (ALF) service details.
Improve this Description on Githubapple
alf_exceptions
OS X application layer firewall (ALF) service exceptions.
Improve this Description on Githubapple
alf_explicit_auths
ALF services explicitly allowed to perform networking.
Improve this Description on Githubapple
app_schemes
OS X application schemes and handlers (e.g., http, file, mailto).
Improve this Description on Githubapple
linux
linux
appcompat_shims
Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.
Improve this Description on Githubwindows
OS X applications installed in known search paths (e.g., /Applications).
Improve this Description on Githubapple
applelinux
arp_cache
Address resolution cache, both static and dynamic (from ARP, NDP).
Improve this Description on Githubapplelinuxwindowsfree-bsd
Queries the Apple System Log data structure for system events.
Improve this Description on Githubapple
atom_packages
Lists all atom packages in a directory or globally installed in a system.
Improve this Description on Githubapplelinuxwindowsfree-bsd
applelinux
authenticode
File (executable, bundle, installer, disk) code signing status.
Improve this Description on Githubwindows
apple
apple
applelinux
autoexec
Aggregate of executables that will automatically execute on the target machine. This is an amalgamation of other tables like services, scheduled_tasks, startup_items and more.
Improve this Description on Githubwindows
applelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
background_activities_moderator
Background Activities Moderator (BAM) tracks application execution.
Improve this Description on Githubwindows
battery
Provides information about the internal battery of a Macbook.
Improve this Description on Githubapple
windows
block_devices
Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.
Improve this Description on Githubapplelinux
bpf_process_events(EVENTED TABLE)
Track time/action process executions.
Improve this Description on Githublinux
bpf_socket_events(EVENTED TABLE)
Track network socket opens and closes.
Improve this Description on Githublinux
apple
carbon_black_info
Returns info about a Carbon Black sensor install.
Improve this Description on Githubapplelinuxwindowsfree-bsd
carves
List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.
Improve this Description on Githubapplelinuxwindowsfree-bsd
certificates
Certificate Authorities installed in Keychains/ca-bundles.
Improve this Description on Githubapplewindows
chassis_info
Display information pertaining to the chassis and its security status.
Improve this Description on Githubwindows
windows
chrome_extension_content_scripts
Chrome browser extension content scripts.
Improve this Description on Githubapplelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
windows
windows
cpu_time
Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.
Improve this Description on Githubapplelinux
applelinuxwindowsfree-bsd
apple
applelinux
apple
apple
Perform an http request and return stats about it.
Improve this Description on Githubapplelinuxwindowsfree-bsd
curl_certificate
Inspect TLS certificates by connecting to input hostnames.
Improve this Description on Githubapplelinuxwindowsfree-bsd
linux
windows
device_file
Similar to the file table, but use TSK and allow block address access.
Improve this Description on Githubapplelinux
device_firmware
A best-effort list of discovered firmware versions.
Improve this Description on Githubapple
device_hash
Similar to the hash table, but use TSK and allow block address access.
Improve this Description on Githubapplelinux
device_partitions
Use TSK to enumerate details about partitions on a disk device.
Improve this Description on Githubapplelinux
applelinux
disk_events(EVENTED TABLE)
Track DMG disk image events (appearance/disappearance) when opened.
Improve this Description on Githubapple
disk_info
Retrieve basic information about the physical disks of a system.
Improve this Description on Githubwindows
dns_cache
Enumerate the DNS cache using the undocumented DnsGetCacheDataTable function in dnsapi.dll.
Improve this Description on Githubwindows
applelinux
docker_container_fs_changes
Changes to files or directories on container's filesystem.
Improve this Description on Githubapplelinux
applelinux
applelinux
applelinux
applelinux
applelinux
docker_container_stats
Docker container statistics. Queries on this table take at least one second.
Improve this Description on Githubapplelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
drivers
Details for in-use Windows device drivers. This does not display installed but unused drivers.
Improve this Description on Githubwindows
applelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
linux
linux
linux
linux
linux
es_process_events(EVENTED TABLE)
Process execution events from EndpointSecurity.
Improve this Description on Githubapple
applelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
apple
applelinuxwindowsfree-bsd
extended_attributes
Returns the extended attributes for files (similar to Windows ADS).
Improve this Description on Githubapplelinux
apple
free-bsd
Interactive filesystem attributes and metadata.
Improve this Description on Githubapplelinuxfree-bsdwindows
file_events(EVENTED TABLE)
Track time/action changes to files specified in configuration data.
Improve this Description on Githubapplelinux
applelinuxwindowsfree-bsd
apple
gatekeeper_approved_apps
Gatekeeper apps a user has allowed to run.
Improve this Description on Githubapple
applelinuxwindowsfree-bsd
hardware_events(EVENTED TABLE)
Hardware (PCI/USB/HID) events from UDEV or IOKit.
Improve this Description on Githubapplelinux
Filesystem hash data.
Improve this Description on Githubapplelinuxwindowsfree-bsd
apple
windows
ibridge_info
Information about the Apple iBridge hardware controller.
Improve this Description on Githubapple
windows
applelinuxfree-bsdwindows
applelinuxwindowsfree-bsd
interface_details
Detailed information and stats of network interfaces.
Improve this Description on Githubapplelinuxwindowsfree-bsd
applelinux
apple
apple
linux
kernel_extensions
OS X's kernel extensions, both loaded and within the load search path.
Improve this Description on Githubapple
applelinuxwindowsfree-bsd
kernel_modules
Linux kernel modules both loaded and within the load search path.
Improve this Description on Githublinux
apple
apple
apple
applelinux
kva_speculative_info
Display kernel virtual address and speculative execution information for the system.
Improve this Description on Githubwindows
System logins and logouts.
Improve this Description on Githubapplelinux
apple
launchd_overrides
Override keys, per user, for LaunchDaemons and Agents.
Improve this Description on Githubapple
listening_ports
Processes with listening (bound) network sockets/ports.
Improve this Description on Githubapplelinuxwindowsfree-bsd
linux
load_average
Displays information about the system wide load averages.
Improve this Description on Githubapplelinux
location_services
Reports the status of the Location Services feature of the OS.
Improve this Description on Githubapple
applelinuxwindowsfree-bsd
logical_drives
Details for logical drives on the system. A logical drive generally represents a single partition.
Improve this Description on Githubwindows
windows
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
applelinux
managed_policies
The managed configuration policies from AD, MDM, MCX, etc.
Improve this Description on Githubapple
linux
linux
linux
apple
Query file metadata in the Spotlight database.
Improve this Description on Githubapple
memory_array_mapped_addresses
Data associated for address mapping of physical memory arrays.
Improve this Description on Githubapplelinux
memory_arrays
Data associated with collection of memory devices that operate to form a memory address.
Improve this Description on Githubapplelinux
memory_device_mapped_addresses
Data associated for address mapping of physical memory devices.
Improve this Description on Githubapplelinux
memory_devices
Physical memory device (type 17) information retrieved from SMBIOS.
Improve this Description on Githubapplelinux
memory_error_info
Data associated with errors of a physical memory array.
Improve this Description on Githubapplelinux
linux
linux
mounts
System mounted devices and filesystems (not process specific).
Improve this Description on Githubapplelinux
Various pieces of data stored in the model specific register per processor. NOTE: the msr kernel module must be enabled, and osquery must be run as root.
Improve this Description on Githublinux
apple
npm_packages
Lists all npm packages in a directory or globally installed in a system.
Improve this Description on Githublinux
ntdomains
Display basic NT domain information of a Windows machine.
Improve this Description on Githubwindows
ntfs_acl_permissions
Retrieve NTFS ACL permission information for files and directories.
Improve this Description on Githubwindows
ntfs_journal_events(EVENTED TABLE)
Track time/action changes to files specified in configuration data.
Improve this Description on Githubwindows
apple
applelinux
windows
os_version
A single row containing the operating system name and version.
Improve this Description on Githubapplelinuxwindowsfree-bsd
osquery_events
Information about the event publishers and subscribers.
Improve this Description on Githubapplelinuxfree-bsdwindows
applelinuxfree-bsdwindows
applelinuxfree-bsdwindows
osquery_info
Top level information about the running version of osquery.
Improve this Description on Githubapplelinuxfree-bsdwindows
osquery_packs
Information about the current query packs that are loaded in osquery.
Improve this Description on Githubapplelinuxfree-bsdwindows
applelinuxfree-bsdwindows
osquery_schedule
Information about the current queries that are scheduled in osquery.
Improve this Description on Githubapplelinuxfree-bsdwindows
apple
apple
apple
patches
Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).
Improve this Description on Githubwindows
applelinux
physical_disk_performance
Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.
Improve this Description on Githubwindows
windows
pkg_packages
pkgng packages that are currently installed on the host system.
Improve this Description on Githubfree-bsd
applelinuxwindowsfree-bsd
apple
portage_keywords
A summary about portage configurations like keywords, mask and unmask.
Improve this Description on Githublinux
linux
portage_use
List of enabled portage USE values for specific package.
Improve this Description on Githublinux
power_sensors
Machine power (currents, voltages, wattages, etc) sensors.
Improve this Description on Githubapple
powershell_events(EVENTED TABLE)
Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.
Improve this Description on Githubwindows
apple
windows
process_envs
A key/value table of environment variables for each process.
Improve this Description on Githubapplelinux
process_events(EVENTED TABLE)
Track time/action process executions.
Improve this Description on Githubapplelinux
process_file_events(EVENTED TABLE)
A File Integrity Monitor implementation using the audit service.
Improve this Description on Githublinux
process_memory_map
Process memory mapped files and pseudo device/regions.
Improve this Description on Githubapplelinuxwindowsfree-bsd
process_namespaces
Linux namespaces for processes running on the host system.
Improve this Description on Githublinux
applelinux
applelinux
process_open_sockets
Processes which have open network sockets on the system.
Improve this Description on Githubapplelinuxwindowsfree-bsd
applelinuxwindowsfree-bsd
programs
Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.
Improve this Description on Githubwindows
applelinux
applelinuxwindowsfree-bsd
quicklook_cache
Files and thumbnails within OS X's Quicklook Cache.
Improve this Description on Githubapple
windows
applelinuxwindowsfree-bsd
rpm_package_files
RPM packages that are currently installed on the host system.
Improve this Description on Githublinux
rpm_packages
RPM packages that are currently installed on the host system.
Improve this Description on Githublinux
running_apps
macOS applications currently running on the host system.
Improve this Description on Githubapple
apple
apple
scheduled_tasks
Lists all of the tasks in the Windows task scheduler.
Improve this Description on Githubwindows
screenlock
macOS screenlock status for the current logged in user context.
Improve this Description on Githubapple
seccomp_events(EVENTED TABLE)
A virtual table that tracks seccomp events.
Improve this Description on Githublinux
applelinuxfree-bsdwindows
linux
linux
services
Lists all installed Windows services and their relevant data.
Improve this Description on Githubwindows
shadow
Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.
Improve this Description on Githublinux
apple
linux
shared_resources
Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.
Improve this Description on Githubwindows
apple
shell_history
A line-delimited (command) table of per-user .*_history data.
Improve this Description on Githubapplelinux
windows
shimcache
Application Compatibility Cache, contains artifacts of execution.
Improve this Description on Githubwindows
windows
signature
File (executable, bundle, installer, disk) code signing status.
Improve this Description on Githubapple
apple
smart_drive_info
Drive information read by SMART controller utilizing autodetect.
Improve this Description on Githubapplelinux
applelinux
apple
socket_events(EVENTED TABLE)
Track network socket opens and closes.
Improve this Description on Githubapplelinux
applelinuxwindowsfree-bsd
startup_items
Applications and binaries set as user/login startup items.
Improve this Description on Githubapplelinuxwindowsfree-bsd
applelinux
applelinux
syslog_events(EVENTED TABLE)
Improve this Description on Githublinux
applelinux
apple
applelinuxwindowsfree-bsd
linux
apple
Track current date and time in the system.
Improve this Description on Githubapplelinuxfree-bsdwindows
apple
time_machine_destinations
Locations backed up to using Time Machine.
Improve this Description on Githubapple
windows
applelinux
uptime
Track time passed since last boot. Some systems track this as calendar time, some as runtime.
Improve this Description on Githubapplelinuxwindowsfree-bsd
usb_devices
USB devices that are actively plugged into the host system.
Improve this Description on Githubapplelinux
user_events(EVENTED TABLE)
Track user events from the audit framework.
Improve this Description on Githubapplelinux
applelinuxwindowsfree-bsd
user_interaction_events(EVENTED TABLE)
Track user interaction events from macOS' event tapping framework.
Improve this Description on Githubapple
user_ssh_keys
Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.
Improve this Description on Githubapplelinuxwindowsfree-bsd
userassist
UserAssist Registry Key tracks when a user executes an application from Windows Explorer.
Improve this Description on Githubwindows
users
Local user accounts (including domain accounts that have logged on locally (Windows)).
Improve this Description on Githubapplelinuxwindowsfree-bsd
windows
apple
apple
apple
apple
winbaseobj
Lists named Windows objects in the default object directories, across all terminal services sessions. Example Windows ojbect types include Mutexes, Events, Jobs and Semaphors.
Improve this Description on Githubwindows
windows_crashes
Extracted information from Windows crash logs (Minidumps).
Improve this Description on Githubwindows
windows_eventlog
Table for querying all recorded Windows event logs.
Improve this Description on Githubwindows
windows
windows_optional_features
Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.
Improve this Description on Githubwindows
windows_security_center
The health status of Window Security features. Health values can be "Good", "Poor". "Snoozed", "Not Monitored", and "Error".
Improve this Description on Githubwindows
windows_security_products
Enumeration of registered Windows security products.
Improve this Description on Githubwindows
windows
wmi_cli_event_consumers
WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.
Improve this Description on Githubwindows
windows
wmi_filter_consumer_binding
Lists the relationship between event consumers and filters.
Improve this Description on Githubwindows
wmi_script_event_consumers
WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.
Improve this Description on Githubwindows
apple
xprotect_meta
Database of the machine's XProtect browser-related signatures.
Improve this Description on Githubapple
xprotect_reports
Database of XProtect matches (if user generated/sent an XProtect report).
Improve this Description on Githubapple
Track YARA matches for files or PIDs.
Improve this Description on Githubapplelinuxwindows
yara_events(EVENTED TABLE)
Track YARA matches for files specified in configuration data.
Improve this Description on Githubapplelinuxwindows
applelinuxwindowsfree-bsd
applelinux
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK