Exported fields referenceedit
The following fields can be returned in osquery results. Note the following about osquery fields:
-
Some fields list multiple descriptions because the one that applies depends on which table was queried. For example, a result stored in the
osquery.autoupdatefield may represent a response from thefirefox_addonstable or thewindows_security_centertable. -
In the cases where a field name is associated with more than one osquery table, we have made a best guess at what the data
typeshould be. In the cases where it is unknown, the data type is set as akeywordobject.
For more information about osquery tables, see the osquery schema documentation.
Fieldsedit
UUID - keyword, text.text
- system_extensions.UUID - Extension unique id
access - keyword, text.text
- ntfs_acl_permissions.access - Specific permissions that indicate the rights described by the ACE.
accessed_directories - keyword, text.text
- prefetch.accessed_directories - Directories accessed by application within ten seconds of launch.
accessed_directories_count - keyword, number.long
- prefetch.accessed_directories_count - Number of directories accessed.
accessed_files - keyword, text.text
- prefetch.accessed_files - Files accessed by application within ten seconds of launch.
accessed_files_count - keyword, number.long
- prefetch.accessed_files_count - Number of files accessed.
accessed_time - keyword, number.long
- shellbags.accessed_time - Directory Accessed time.
account - keyword, text.text
- keychain_items.account - Optional item account
account_id - keyword, text.text
- ec2_instance_metadata.account_id - AWS account ID which owns this EC2 instance
action - keyword, text.text
- disk_events.action - Appear or disappear
- file_events.action - Change action (UPDATE, REMOVE, etc)
- hardware_events.action - Remove, insert, change properties, etc
- ntfs_journal_events.action - Change action (Write, Delete, etc)
- scheduled_tasks.action - Actions executed by the scheduled task
- socket_events.action - The socket action (bind, listen, close)
- windows_firewall_rules.action - Action for the rule or default setting
- yara_events.action - Change action (UPDATE, REMOVE, etc)
activated - keyword, number.long
- tpm_info.activated - TPM is activated
active - keyword, number.long
- firefox_addons.active - 1 If the addon is active else 0
- memory_info.active - The total amount of buffer or page cache memory, in bytes, that is in active use
- osquery_events.active - 1 if the publisher or subscriber is active else 0
- osquery_packs.active - Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.
- osquery_registry.active - 1 If this plugin is active else 0
- virtual_memory_info.active - Total number of active pages.
active_disks - keyword, number.long
- md_devices.active_disks - Number of active disks in array
active_state - keyword, text.text
- systemd_units.active_state - The high-level unit activation state, i.e. generalization of SUB
activity - keyword, number.long
- unified_log.activity - the activity ID associate with the entry
actual - keyword, number.long
- fan_speed_sensors.actual - Actual speed
add_reason - keyword, text.text
- wifi_networks.add_reason - Shows why this network was added, via menubar or command line or something else
added_at - keyword, number.long
- wifi_networks.added_at - Time this network was added as a unix_time
additional_properties - keyword, text.text
- windows_search.additional_properties - Comma separated list of columns to include in properties JSON
address - keyword, text.text
- arp_cache.address - IPv4 address target
- dns_resolvers.address - Resolver IP/IPv6 address
- etc_hosts.address - IP address mapping
- interface_addresses.address - Specific address for interface
- kernel_modules.address - Kernel module address
- listening_ports.address - Specific address for bind
- platform_info.address - Relative address of firmware mapping
- user_events.address - The Internet protocol address or family ID
address_width - keyword, text.text
- cpu_info.address_width - The width of the CPU address bus.
admindir - keyword, text.text
- deb_packages.admindir - libdpkg admindir. Defaults to /var/lib/dpkg
algorithm - keyword, text.text
- authorized_keys.algorithm - Key type
alias - keyword, text.text
- etc_protocols.alias - Protocol alias
- time_machine_destinations.alias - Human readable name of drive
aliases - keyword, text.text
- etc_services.aliases - Optional space separated list of other names for a service
- lxd_images.aliases - Comma-separated list of image aliases
allow_maximum - keyword, number.long
- shared_resources.allow_maximum - Number of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.
allow_root - keyword, text.text
- authorizations.allow_root - Label top-level key
allow_signed_enabled - keyword, number.long
- alf.allow_signed_enabled - 1 If allow signed mode is enabled else 0
ambient_brightness_enabled - keyword, text.text
- connected_displays.ambient_brightness_enabled - The ambient brightness setting associated with the display. This will be 1 if enabled and is 0 if disabled or not supported.
ami_id - keyword, text.text
- ec2_instance_metadata.ami_id - AMI ID used to launch this EC2 instance
amperage - keyword, number.long
- battery.amperage - The battery’s current amperage in mA
anonymous - keyword, number.long
- virtual_memory_info.anonymous - Total number of anonymous pages.
antispyware - keyword, text.text
- windows_security_center.antispyware - Deprecated (always Good).
antivirus - keyword, text.text
- windows_security_center.antivirus - The health of the monitored Antivirus solution (see windows_security_products)
api_version - keyword, text.text
- docker_version.api_version - API version
app_name - keyword, text.text
- windows_firewall_rules.app_name - Friendly name of the application to which the rule applies
apparmor - keyword, text.text
- apparmor_events.apparmor - Apparmor Status like ALLOWED, DENIED etc.
applescript_enabled - keyword, text.text
- apps.applescript_enabled - Info properties NSAppleScriptEnabled label
application - keyword, text.text
- office_mru.application - Associated Office application
arch - keyword, text.text
- deb_packages.arch - Package architecture
- docker_version.arch - Hardware architecture
- os_version.arch - OS Architecture
- rpm_packages.arch - Architecture(s) supported
- seccomp_events.arch - Information about the CPU architecture
- signature.arch - If applicable, the arch of the signed code
architecture - keyword, text.text
- docker_info.architecture - Hardware architecture
- ec2_instance_metadata.architecture - Hardware architecture of this EC2 instance
- lxd_images.architecture - Target architecture for the image
- lxd_instances.architecture - Instance architecture
architectures - keyword, text.text
- apt_sources.architectures - Repository architectures
args - keyword, text.text
- startup_items.args - Arguments provided to startup executable
arguments - keyword, text.text
- kernel_info.arguments - Kernel arguments
array_handle - keyword, text.text
- memory_devices.array_handle - The memory array that the device is attached to
assessments_enabled - keyword, number.long
- gatekeeper.assessments_enabled - 1 If a Gatekeeper is enabled else 0
asset_tag - keyword, text.text
- memory_devices.asset_tag - Manufacturer specific asset tag of memory device
atime - keyword, number.long
- device_file.atime - Last access time
- file.atime - Last access time
- file_events.atime - Last access time
- process_events.atime - File last access in UNIX time
- shared_memory.atime - Attached time
attach - keyword, text.text
- apparmor_profiles.attach - Which executable(s) a profile will attach to.
attached - keyword, number.long
- shared_memory.attached - Number of attached processes
attributes - keyword, text.text
- file.attributes - File attrib string. See: https://ss64.com/nt/attrib.html
audible_alarm - keyword, text.text
- chassis_info.audible_alarm - If TRUE, the frame is equipped with an audible alarm.
audit_account_logon - keyword, number.long
- security_profile_info.audit_account_logon - Determines whether the operating system MUST audit each time this computer validates the credentials of an account
audit_account_manage - keyword, number.long
- security_profile_info.audit_account_manage - Determines whether the operating system MUST audit each event of account management on a computer
audit_ds_access - keyword, number.long
- security_profile_info.audit_ds_access - Determines whether the operating system MUST audit each instance of user attempts to access an Active Directory object that has its own system access control list (SACL) specified
audit_logon_events - keyword, number.long
- security_profile_info.audit_logon_events - Determines whether the operating system MUST audit each instance of a user attempt to log on or log off this computer
audit_object_access - keyword, number.long
- security_profile_info.audit_object_access - Determines whether the operating system MUST audit each instance of user attempts to access a non-Active Directory object that has its own SACL specified
audit_policy_change - keyword, number.long
- security_profile_info.audit_policy_change - Determines whether the operating system MUST audit each instance of user attempts to change user rights assignment policy, audit policy, account policy, or trust policy
audit_privilege_use - keyword, number.long
- security_profile_info.audit_privilege_use - Determines whether the operating system MUST audit each instance of user attempts to exercise a user right
audit_process_tracking - keyword, number.long
- security_profile_info.audit_process_tracking - Determines whether the operating system MUST audit process-related events
audit_system_events - keyword, number.long
- security_profile_info.audit_system_events - Determines whether the operating system MUST audit System Change, System Startup, System Shutdown, Authentication Component Load, and Loss or Excess of Security events
auid - keyword
- process_events.auid - Audit User ID at process start
- process_file_events.auid - Audit user ID of the process using the file
- seccomp_events.auid - Audit user ID (loginuid) of the user who started the analyzed process
- socket_events.auid - Audit User ID
- user_events.auid - Audit User ID
authenticate_user - keyword, text.text
- authorizations.authenticate_user - Label top-level key
authentication_package - keyword, text.text
- logon_sessions.authentication_package - The authentication package used to authenticate the owner of the logon session.
author - keyword, text.text
- chocolatey_packages.author - Optional package author
- chrome_extensions.author - Optional extension author
- npm_packages.author - Package-supplied author
- python_packages.author - Optional package author
- safari_extensions.author - Optional extension author
authority - keyword, text.text
- signature.authority - Certificate Common Name
authority_key_id - keyword, text.text
- certificates.authority_key_id - AKID an optionally included SHA1
authority_key_identifier - keyword, text.text
- curl_certificate.authority_key_identifier - Authority Key Identifier
authorizations - keyword, text.text
- keychain_acls.authorizations - A space delimited set of authorization attributes
auto_join - keyword, number.long
- wifi_networks.auto_join - 1 if this network set to join automatically, 0 otherwise
auto_login - keyword, number.long
- wifi_networks.auto_login - 1 if auto login is enabled, 0 otherwise
auto_update - keyword, number.long
- lxd_images.auto_update - Whether the image auto-updates (1) or not (0)
autoupdate - keyword
- firefox_addons.autoupdate - 1 If the addon applies background updates else 0
- windows_security_center.autoupdate - The health of the Windows Autoupdate feature
availability - keyword, text.text
- cpu_info.availability - The availability and status of the CPU.
availability_zone - keyword, text.text
- ec2_instance_metadata.availability_zone - Availability zone in which this instance launched
average - keyword, text.text
- load_average.average - Load average over the specified period.
average_memory - keyword, number.long
- osquery_schedule.average_memory - Average of the bytes of resident memory left allocated after collecting results
avg_disk_bytes_per_read - keyword, number.long
- physical_disk_performance.avg_disk_bytes_per_read - Average number of bytes transferred from the disk during read operations
avg_disk_bytes_per_write - keyword, number.long
- physical_disk_performance.avg_disk_bytes_per_write - Average number of bytes transferred to the disk during write operations
avg_disk_read_queue_length - keyword, number.long
- physical_disk_performance.avg_disk_read_queue_length - Average number of read requests that were queued for the selected disk during the sample interval
avg_disk_sec_per_read - keyword, number.long
- physical_disk_performance.avg_disk_sec_per_read - Average time, in seconds, of a read operation of data from the disk
avg_disk_sec_per_write - keyword, number.long
- physical_disk_performance.avg_disk_sec_per_write - Average time, in seconds, of a write operation of data to the disk
avg_disk_write_queue_length - keyword, number.long
- physical_disk_performance.avg_disk_write_queue_length - Average number of write requests that were queued for the selected disk during the sample interval
backup_date - keyword, number.long
- time_machine_backups.backup_date - Backup Date
bank_locator - keyword, text.text
- memory_devices.bank_locator - String number of the string that identifies the physically-labeled bank where the memory device is located
base64 - keyword, number.long
- extended_attributes.base64 - 1 if the value is base64 encoded else 0
base_image - keyword, text.text
- lxd_instances.base_image - ID of image used to launch this instance
base_uri - keyword, text.text
- apt_sources.base_uri - Repository base URI
baseurl - keyword, text.text
- yum_sources.baseurl - Repository base URL
basic_constraint - keyword, text.text
- curl_certificate.basic_constraint - Basic Constraints
binary_queue - keyword, number.long
- carbon_black_info.binary_queue - Size in bytes of binaries waiting to be sent to Carbon Black server
bitmap_chunk_size - keyword, text.text
- md_devices.bitmap_chunk_size - Bitmap chunk size
bitmap_external_file - keyword, text.text
- md_devices.bitmap_external_file - External referenced bitmap file
bitmap_on_mem - keyword, text.text
- md_devices.bitmap_on_mem - Pages allocated in in-memory bitmap, if enabled
block - keyword, text.text
- ssh_configs.block - The host or match block
block_size - keyword, number.long
- block_devices.block_size - Block size in bytes
- device_file.block_size - Block size of filesystem
- file.block_size - Block size of filesystem
blocks - keyword, number.long
- device_partitions.blocks - Number of blocks
- mounts.blocks - Mounted device used blocks
blocks_available - keyword, number.long
- mounts.blocks_available - Mounted device available blocks
blocks_free - keyword, number.long
- mounts.blocks_free - Mounted device free blocks
blocks_size - keyword, number.long
- device_partitions.blocks_size - Byte size of each block
- mounts.blocks_size - Block size in bytes
bluetooth_sharing - keyword, number.long
- sharing_preferences.bluetooth_sharing - 1 If bluetooth sharing is enabled for any user else 0
board_model - keyword, text.text
- system_info.board_model - Board model
board_serial - keyword, text.text
- system_info.board_serial - Board serial number
board_vendor - keyword, text.text
- system_info.board_vendor - Board vendor
board_version - keyword, text.text
- system_info.board_version - Board version
boot_partition - keyword, number.long
- logical_drives.boot_partition - True if Windows booted from this drive.
boot_uuid - keyword, text.text
- ibridge_info.boot_uuid - Boot UUID of the iBridge controller
bp_microcode_disabled - keyword, number.long
- kva_speculative_info.bp_microcode_disabled - Branch Predictions are disabled due to lack of microcode update.
bp_mitigations - keyword, number.long
- kva_speculative_info.bp_mitigations - Branch Prediction mitigations are enabled.
bp_system_pol_disabled - keyword, number.long
- kva_speculative_info.bp_system_pol_disabled - Branch Predictions are disabled via system policy.
breach_description - keyword, text.text
- chassis_info.breach_description - If provided, gives a more detailed description of a detected security breach.
bridge_nf_ip6tables - keyword, number.long
- docker_info.bridge_nf_ip6tables - 1 if bridge netfilter ip6tables is enabled. 0 otherwise
bridge_nf_iptables - keyword, number.long
- docker_info.bridge_nf_iptables - 1 if bridge netfilter iptables is enabled. 0 otherwise
broadcast - keyword, text.text
- interface_addresses.broadcast - Broadcast address for the interface
browser_type - keyword, text.text
- chrome_extension_content_scripts.browser_type - The browser type (Valid values: chrome, chromium, opera, yandex, brave)
- chrome_extensions.browser_type - The browser type (Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta)
bsd_flags - keyword, text.text
- file.bsd_flags - The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND
bssid - keyword, text.text
- wifi_status.bssid - The current basic service set identifier
- wifi_survey.bssid - The current basic service set identifier
btime - keyword, number.long
- file.btime - (B)irth or (cr)eate time
- process_events.btime - File creation in UNIX time
buffers - keyword, number.long
- memory_info.buffers - The amount of physical RAM, in bytes, used for file buffers
build - keyword, text.text
- os_version.build - Optional build-specific or variant string
build_distro - keyword, text.text
- osquery_info.build_distro - osquery toolkit platform distribution name (os version)
build_id - keyword, text.text
- sandboxes.build_id - Sandbox-specific identifier
build_number - keyword, number.long
- windows_crashes.build_number - Windows build number of the crashing machine
build_platform - keyword, text.text
- osquery_info.build_platform - osquery toolkit build platform
build_time - keyword, text.text
- docker_version.build_time - Build time
- portage_packages.build_time - Unix time when package was built
bundle_executable - keyword, text.text
- apps.bundle_executable - Info properties CFBundleExecutable label
bundle_identifier - keyword, text.text
- apps.bundle_identifier - Info properties CFBundleIdentifier label
- running_apps.bundle_identifier - The bundle identifier of the application
bundle_name - keyword, text.text
- apps.bundle_name - Info properties CFBundleName label
bundle_package_type - keyword, text.text
- apps.bundle_package_type - Info properties CFBundlePackageType label
bundle_path - keyword, text.text
- sandboxes.bundle_path - Application bundle used by the sandbox
- system_extensions.bundle_path - System extension bundle path
bundle_short_version - keyword, text.text
- apps.bundle_short_version - Info properties CFBundleShortVersionString label
bundle_version - keyword, text.text
- apps.bundle_version - Info properties CFBundleVersion label
- safari_extensions.bundle_version - The version of the build that identifies an iteration of the bundle
busy_state - keyword, number.long
- iokit_devicetree.busy_state - 1 if the device is in a busy state else 0
- iokit_registry.busy_state - 1 if the node is in a busy state else 0
bytes - keyword, number.long
- curl.bytes - Number of bytes in the response
- iptables.bytes - Number of matching bytes for this rule.
bytes_available - keyword, number.long
- time_machine_destinations.bytes_available - Bytes available on volume
bytes_received - keyword, number.long
- lxd_networks.bytes_received - Number of bytes received on this network
bytes_sent - keyword, number.long
- lxd_networks.bytes_sent - Number of bytes sent on this network
bytes_used - keyword, number.long
- time_machine_destinations.bytes_used - Bytes used on volume
ca - keyword, number.long
- certificates.ca - 1 if CA: true (certificate is an authority) else 0
cache_path - keyword, text.text
- quicklook_cache.cache_path - Path to cache data
cached - keyword, number.long
- lxd_images.cached - Whether image is cached (1) or not (0)
- memory_info.cached - The amount of physical RAM, in bytes, used as cache memory
capability - keyword, number.long
- apparmor_events.capability - Capability number
capname - keyword, text.text
- apparmor_events.capname - Capability requested by the process
caption - keyword, text.text
- patches.caption - Short description of the patch.
- windows_optional_features.caption - Caption of feature in settings UI
captive_login_date - keyword, number.long
- wifi_networks.captive_login_date - Time this network logged in to a captive portal as unix_time
captive_portal - keyword, number.long
- wifi_networks.captive_portal - 1 if this network has a captive portal, 0 otherwise
carve - keyword, number.long
- carves.carve - Set this value to 1 to start a file carve
carve_guid - keyword, text.text
- carves.carve_guid - Identifying value of the carve session
category - keyword, text.text
- apps.category - The UTI that categorizes the app for the App Store
- file_events.category - The category of the file defined in the config
- ntfs_journal_events.category - The category that the event originated from
- power_sensors.category - The sensor category: currents, voltage, wattage
- system_extensions.category - System extension category
- unified_log.category - the category of the os_log_t used
- yara_events.category - The category of the file
cdhash - keyword, text.text
- es_process_events.cdhash - Codesigning hash of the process
- signature.cdhash - Hash of the application Code Directory
celsius - keyword, number.double
- temperature_sensors.celsius - Temperature in Celsius
certificate - keyword, text.text
- lxd_certificates.certificate - Certificate content
cgroup_driver - keyword, text.text
- docker_info.cgroup_driver - Control groups driver
cgroup_namespace - keyword, text.text
- docker_containers.cgroup_namespace - cgroup namespace
- process_namespaces.cgroup_namespace - cgroup namespace inode
cgroup_path - keyword, text.text
- processes.cgroup_path - The full hierarchical path of the process’s control group
chain - keyword, text.text
- iptables.chain - Size of module content.
change_type - keyword, text.text
- docker_container_fs_changes.change_type - Type of change: C:Modified, A:Added, D:Deleted
channel - keyword
- wifi_status.channel - Channel number
- wifi_survey.channel - Channel number
- windows_eventlog.channel - Source or channel of the event
channel_band - keyword, number.long
- wifi_status.channel_band - Channel band
- wifi_survey.channel_band - Channel band
channel_width - keyword, number.long
- wifi_status.channel_width - Channel width
- wifi_survey.channel_width - Channel width
charged - keyword, number.long
- battery.charged - 1 if the battery is currently completely charged. 0 otherwise
charging - keyword, number.long
- battery.charging - 1 if the battery is currently being charged by a power source. 0 otherwise
chassis_types - keyword, text.text
- chassis_info.chassis_types - A comma-separated list of chassis types, such as Desktop or Laptop.
check_array_finish - keyword, text.text
- md_devices.check_array_finish - Estimated duration of the check array activity
check_array_progress - keyword, text.text
- md_devices.check_array_progress - Progress of the check array activity
check_array_speed - keyword, text.text
- md_devices.check_array_speed - Speed of the check array activity
checksum - keyword, text.text
- disk_events.checksum - UDIF Master checksum if available (CRC32)
child_pid - keyword, number.long
- es_process_events.child_pid - Process ID of a child process in case of a fork event
chunk_size - keyword, number.long
- md_devices.chunk_size - chunk size in bytes
cid - keyword, number.long
- bpf_process_events.cid - Cgroup ID
- bpf_socket_events.cid - Cgroup ID
class - keyword, text.text
- authorizations.class - Label top-level key
- drivers.class - Device/driver class name
- iokit_devicetree.class - Best matching device class (most-specific category)
- iokit_registry.class - Best matching device class (most-specific category)
- usb_devices.class - USB Device class
- wmi_cli_event_consumers.class - The name of the class.
- wmi_event_filters.class - The name of the class.
- wmi_filter_consumer_binding.class - The name of the class.
- wmi_script_event_consumers.class - The name of the class.
clear_text_password - keyword, number.long
- security_profile_info.clear_text_password - Determines whether passwords MUST be stored by using reversible encryption
client_app_id - keyword, text.text
- windows_update_history.client_app_id - Identifier of the client application that processed an update
client_site_name - keyword, text.text
- ntdomains.client_site_name - The name of the site where the domain controller is configured.
cloud_id - keyword, text.text
- ycloud_instance_metadata.cloud_id - Cloud identifier for the VM
cmdline - keyword, text.text
- bpf_process_events.cmdline - Command line arguments
- docker_container_processes.cmdline - Complete argv
- es_process_events.cmdline - Command line arguments (argv)
- process_etw_events.cmdline - Command Line
- process_events.cmdline - Command line arguments (argv)
- processes.cmdline - Complete argv
cmdline_count - keyword, number.long
- es_process_events.cmdline_count - Number of command line arguments
cmdline_size - keyword, number.long
- process_events.cmdline_size - Actual size (bytes) of command line arguments
code - keyword, text.text
- seccomp_events.code - The seccomp action
code_integrity_policy_enforcement_status - keyword, text.text
- hvci_status.code_integrity_policy_enforcement_status - The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.
codename - keyword, text.text
- os_version.codename - OS version codename
codesigning_flags - keyword, text.text
- es_process_events.codesigning_flags - Codesigning flags matching one of these options, in a comma separated list: NOT_VALID, ADHOC, NOT_RUNTIME, INSTALLER. See kern/cs_blobs.h in XNU for descriptions.
collect_cross_processes - keyword, number.long
- carbon_black_info.collect_cross_processes - If the sensor is configured to cross process events
collect_data_file_writes - keyword, number.long
- carbon_black_info.collect_data_file_writes - If the sensor is configured to collect non binary file writes
collect_emet_events - keyword, number.long
- carbon_black_info.collect_emet_events - If the sensor is configured to EMET events
collect_file_mods - keyword, number.long
- carbon_black_info.collect_file_mods - If the sensor is configured to collect file modification events
collect_module_info - keyword, number.long
- carbon_black_info.collect_module_info - If the sensor is configured to collect metadata of binaries
collect_module_loads - keyword, number.long
- carbon_black_info.collect_module_loads - If the sensor is configured to capture module loads
collect_net_conns - keyword, number.long
- carbon_black_info.collect_net_conns - If the sensor is configured to collect network connections
collect_process_user_context - keyword, number.long
- carbon_black_info.collect_process_user_context - If the sensor is configured to collect the user running a process
collect_processes - keyword, number.long
- carbon_black_info.collect_processes - If the sensor is configured to process events
collect_reg_mods - keyword, number.long
- carbon_black_info.collect_reg_mods - If the sensor is configured to collect registry modification events
collect_sensor_operations - keyword, number.long
- carbon_black_info.collect_sensor_operations - Unknown
collect_store_files - keyword, number.long
- carbon_black_info.collect_store_files - If the sensor is configured to send back binaries to the Carbon Black server
collisions - keyword, number.long
- interface_details.collisions - Packet Collisions detected
color_depth - keyword, number.long
- video_info.color_depth - The amount of bits per pixel to represent color.
comm - keyword, text.text
- apparmor_events.comm - Command-line name of the command that was used to invoke the analyzed process
- seccomp_events.comm - Command-line name of the command that was used to invoke the analyzed process
command - keyword, text.text
- crontab.command - Raw command string
- docker_containers.command - Command with arguments
- shell_history.command - Unparsed date/line/command history line
command_line - keyword, text.text
- windows_crashes.command_line - Command-line string passed to the crashed process
command_line_template - keyword, text.text
- wmi_cli_event_consumers.command_line_template - Standard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.
comment - keyword, text.text
- authorizations.comment - Label top-level key
- authorized_keys.comment - Optional comment
- docker_image_history.comment - Instruction comment
- etc_protocols.comment - Comment with protocol description
- etc_services.comment - Optional comment for a service.
- groups.comment - Remarks or comments associated with the group
- keychain_items.comment - Optional keychain comment
common_name - keyword, text.text
- certificates.common_name - Certificate CommonName
- curl_certificate.common_name - Common name of company issued to
compat - keyword, number.long
- seccomp_events.compat - Is system call in compatibility mode
compiler - keyword, text.text
- apps.compiler - Info properties DTCompiler label
completed_time - keyword, number.long
- cups_jobs.completed_time - When the job completed printing
components - keyword, text.text
- apt_sources.components - Repository components
compressed - keyword, number.long
- virtual_memory_info.compressed - The total number of pages that have been compressed by the VM compressor.
compressor - keyword, number.long
- virtual_memory_info.compressor - The number of pages used to store compressed VM pages.
computer_name - keyword, text.text
- system_info.computer_name - Friendly computer name (optional)
- windows_eventlog.computer_name - Hostname of system where event was generated
- windows_events.computer_name - Hostname of system where event was generated
condition - keyword, text.text
- battery.condition - One of the following: "Normal" indicates the condition of the battery is within normal tolerances, "Service Needed" indicates that the battery should be checked out by a licensed Mac repair service, "Permanent Failure" indicates the battery needs replacement
config_entrypoint - keyword, text.text
- docker_containers.config_entrypoint - Container entrypoint(s)
config_flag - keyword, text.text
- sip_config.config_flag - The System Integrity Protection config flag
config_hash - keyword, text.text
- osquery_info.config_hash - Hash of the working configuration state
config_name - keyword, text.text
- carbon_black_info.config_name - Sensor group
config_valid - keyword, number.long
- osquery_info.config_valid - 1 if the config was loaded and considered valid, else 0
config_value - keyword, text.text
- system_controls.config_value - The MIB value set in /etc/sysctl.conf
configured_clock_speed - keyword, number.long
- memory_devices.configured_clock_speed - Configured speed of memory device in megatransfers per second (MT/s)
configured_voltage - keyword, number.long
- memory_devices.configured_voltage - Configured operating voltage of device in millivolts
connection_id - keyword, text.text
- interface_details.connection_id - Name of the network connection as it appears in the Network Connections Control Panel program.
connection_status - keyword, text.text
- interface_details.connection_status - State of the network adapter connection to the network.
connection_type - keyword, text.text
- connected_displays.connection_type - The connection type associated with the display.
consistency_scan_date - keyword, number.long
- time_machine_destinations.consistency_scan_date - Consistency scan date
consumer - keyword, text.text
- wmi_filter_consumer_binding.consumer - Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.
containers - keyword, number.long
- docker_info.containers - Total number of containers
containers_paused - keyword, number.long
- docker_info.containers_paused - Number of containers in paused state
containers_running - keyword, number.long
- docker_info.containers_running - Number of containers currently running
containers_stopped - keyword, number.long
- docker_info.containers_stopped - Number of containers in stopped state
content - keyword, text.text
- disk_events.content - Disk event content
content_caching - keyword, number.long
- sharing_preferences.content_caching - 1 If content caching is enabled else 0
content_type - keyword, text.text
- package_install_history.content_type - Package content_type (optional)
conversion_status - keyword, number.long
- bitlocker_info.conversion_status - The bitlocker conversion status of the drive.
coprocessor_version - keyword, text.text
- ibridge_info.coprocessor_version - The manufacturer and chip version
copy - keyword, number.long
- virtual_memory_info.copy - Total number of copy-on-write pages.
copyright - keyword, text.text
- apps.copyright - Info properties NSHumanReadableCopyright label
- safari_extensions.copyright - A human-readable copyright notice for the bundle
core - keyword, number.long
- cpu_time.core - Name of the cpu (core)
cosine_similarity - keyword, number.double
- powershell_events.cosine_similarity - How similar the Powershell script is to a provided normal character frequency
count - keyword, number.long
- userassist.count - Number of times the application has been executed.
- yara.count - Number of YARA matches
- yara_events.count - Number of YARA matches
country_code - keyword, text.text
- wifi_status.country_code - The country code (ISO/IEC 3166-1:1997) for the network
- wifi_survey.country_code - The country code (ISO/IEC 3166-1:1997) for the network
cpu - keyword, number.double
- docker_container_processes.cpu - CPU utilization as percentage
cpu_brand - keyword, text.text
- system_info.cpu_brand - CPU brand string, contains vendor and model
cpu_cfs_period - keyword, number.long
- docker_info.cpu_cfs_period - 1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise
cpu_cfs_quota - keyword, number.long
- docker_info.cpu_cfs_quota - 1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise
cpu_kernelmode_usage - keyword, number.long
- docker_container_stats.cpu_kernelmode_usage - CPU kernel mode usage
cpu_logical_cores - keyword, number.long
- system_info.cpu_logical_cores - Number of logical CPU cores available to the system
cpu_microcode - keyword, text.text
- system_info.cpu_microcode - Microcode version
cpu_physical_cores - keyword, number.long
- system_info.cpu_physical_cores - Number of physical CPU cores in to the system
cpu_pred_cmd_supported - keyword, number.long
- kva_speculative_info.cpu_pred_cmd_supported - PRED_CMD MSR supported by CPU Microcode.
cpu_set - keyword, number.long
- docker_info.cpu_set - 1 if CPU set selection support is enabled. 0 otherwise
cpu_shares - keyword, number.long
- docker_info.cpu_shares - 1 if CPU share weighting support is enabled. 0 otherwise
cpu_sockets - keyword, number.long
- system_info.cpu_sockets - Number of processor sockets in the system
cpu_spec_ctrl_supported - keyword, number.long
- kva_speculative_info.cpu_spec_ctrl_supported - SPEC_CTRL MSR supported by CPU Microcode.
cpu_status - keyword, number.long
- cpu_info.cpu_status - The current operating status of the CPU.
cpu_subtype - keyword
- processes.cpu_subtype - Indicates the specific processor on which an entry may be used.
- system_info.cpu_subtype - CPU subtype
cpu_total_usage - keyword, number.long
- docker_container_stats.cpu_total_usage - Total CPU usage
cpu_type - keyword
- processes.cpu_type - Indicates the specific processor designed for installation.
- system_info.cpu_type - CPU type
cpu_usermode_usage - keyword, number.long
- docker_container_stats.cpu_usermode_usage - CPU user mode usage
cpus - keyword, number.long
- docker_info.cpus - Number of CPUs
crash_path - keyword, text.text
- crashes.crash_path - Location of log file
- windows_crashes.crash_path - Path of the log file
crashed_thread - keyword, number.long
- crashes.crashed_thread - Thread ID which crashed
created - keyword, text.text
- authorizations.created - Label top-level key
- docker_containers.created - Time of creation as UNIX time
- docker_image_history.created - Time of creation as UNIX time
- docker_images.created - Time of creation as UNIX time
- docker_networks.created - Time of creation as UNIX time
- keychain_items.created - Date item was created
created_at - keyword, text.text
- lxd_images.created_at - ISO time of image creation
- lxd_instances.created_at - ISO time of creation
created_by - keyword, text.text
- docker_image_history.created_by - Created by instruction
created_time - keyword, number.long
- shellbags.created_time - Directory Created time.
creation_time - keyword
- account_policy_data.creation_time - When the account was first created
- cups_jobs.creation_time - When the print request was initiated
creator - keyword, text.text
- firefox_addons.creator - Addon-supported creator string
creator_pid - keyword, number.long
- shared_memory.creator_pid - Process ID that created the segment
creator_uid - keyword, number.long
- shared_memory.creator_uid - User ID of creator process
csname - keyword, text.text
- patches.csname - The name of the host the patch is installed on.
ctime - keyword
- device_file.ctime - Creation time
- file.ctime - Last status change time
- file_events.ctime - Last status change time
- gatekeeper_approved_apps.ctime - Last change time
- process_events.ctime - File last metadata change in UNIX time
- shared_memory.ctime - Changed time
current_capacity - keyword, number.long
- battery.current_capacity - The battery’s current charged capacity in mAh
current_clock_speed - keyword, number.long
- cpu_info.current_clock_speed - The current frequency of the CPU.
current_directory - keyword, text.text
- windows_crashes.current_directory - Current working directory of the crashed process
current_disk_queue_length - keyword, number.long
- physical_disk_performance.current_disk_queue_length - Number of requests outstanding on the disk at the time the performance data is collected
current_locale - keyword, text.text
- chrome_extensions.current_locale - Current locale supported by extension
current_value - keyword, text.text
- system_controls.current_value - Value of setting
cwd - keyword, text.text
- bpf_process_events.cwd - Current working directory
- es_process_events.cwd - The process current working directory
- process_events.cwd - The process current working directory
- process_file_events.cwd - The current working directory of the process
- processes.cwd - Process current working directory
cycle_count - keyword, number.long
- battery.cycle_count - The number of charge/discharge cycles
data - keyword, text.text
- magic.data - Magic number data from libmagic
- registry.data - Data content of registry value
- windows_eventlog.data - Data associated with the event
- windows_events.data - Data associated with the event
data_width - keyword, number.long
- memory_devices.data_width - Data width, in bits, of this memory device
database - keyword, number.long
- lxd_cluster_members.database - Whether the server is a database node (1) or not (0)
date - keyword
- drivers.date - Driver date
- platform_info.date - Self-reported platform code update date
- windows_update_history.date - Date and the time an update was applied
date_created - keyword, number.long
- windows_search.date_created - The unix timestamp of when the item was created.
date_modified - keyword, number.long
- windows_search.date_modified - The unix timestamp of when the item was last modified
datetime - keyword, text.text
- crashes.datetime - Date/Time at which the crash occurred
- powershell_events.datetime - System time at which the Powershell script event occurred
- process_etw_events.datetime - Event timestamp in DATETIME format
- syslog_events.datetime - Time known to syslog
- time.datetime - Current date and time (ISO format) in UTC
- windows_crashes.datetime - Timestamp (log format) of the crash
- windows_eventlog.datetime - System time at which the event occurred
- windows_events.datetime - System time at which the event occurred
day - keyword, number.long
- time.day - Current day in UTC
day_of_month - keyword, text.text
- crontab.day_of_month - The day of the month for the job
day_of_week - keyword, text.text
- crontab.day_of_week - The day of the week for the job
days - keyword, number.long
- uptime.days - Days of uptime
dc_site_name - keyword, text.text
- ntdomains.dc_site_name - The name of the site where the domain controller is located.
decompressed - keyword, number.long
- virtual_memory_info.decompressed - The total number of pages that have been decompressed by the VM compressor.
default_locale - keyword, text.text
- chrome_extensions.default_locale - Default locale supported by extension
default_value - keyword, text.text
- osquery_flags.default_value - Flag default value
denied_mask - keyword, text.text
- apparmor_events.denied_mask - Denied permissions for the process
denylisted - keyword, number.long
- osquery_schedule.denylisted - 1 if the query is denylisted else 0
dependencies - keyword, text.text
- kernel_panics.dependencies - Module dependencies existing in crashed module’s backtrace
depth - keyword, number.long
- iokit_devicetree.depth - Device nested depth
- iokit_registry.depth - Node nested depth
description - keyword, text.text
- appcompat_shims.description - Description of the SDB.
- atom_packages.description - Package supplied description
- browser_plugins.description - Plugin description text
- chassis_info.description - An extended description of the chassis if available.
- chrome_extensions.description - Extension-optional description
- disk_info.description - The OS’s description of the disk.
- drivers.description - Driver description
- firefox_addons.description - Addon-supplied description string
- interface_details.description - Short description of the object a one-line string.
- kernel_keys.description - The key description.
- keychain_acls.description - The description included with the ACL entry
- keychain_items.description - Optional item description
- logical_drives.description - The canonical description of the drive, e.g. Logical Fixed Disk, CD-ROM Disk.
- lxd_images.description - Image description
- lxd_instances.description - Instance description
- npm_packages.description - Package-supplied description
- osquery_flags.description - Flag description
- patches.description - Fuller description of the patch.
- safari_extensions.description - Optional extension description text
- services.description - Service Description
- shared_resources.description - A textual description of the object
- smbios_tables.description - Table entry description
- systemd_units.description - Unit description
- users.description - Optional user description
- windows_update_history.description - Description of an update
- ycloud_instance_metadata.description - Description of the VM
designed_capacity - keyword, number.long
- battery.designed_capacity - The battery’s designed capacity in mAh
dest_filename - keyword, text.text
- es_process_file_events.dest_filename - Destination filename for the event
dest_path - keyword, text.text
- process_file_events.dest_path - The canonical path associated with the event
destination - keyword, text.text
- cups_jobs.destination - The printer the job was sent to
- docker_container_mounts.destination - Destination path inside container
- routes.destination - Destination IP address
destination_id - keyword, text.text
- time_machine_backups.destination_id - Time Machine destination ID
- time_machine_destinations.destination_id - Time Machine destination ID
dev_id_enabled - keyword, number.long
- gatekeeper.dev_id_enabled - 1 If a Gatekeeper allows execution from identified developers else 0
developer_id - keyword, text.text
- safari_extensions.developer_id - Optional developer identifier
- xprotect_meta.developer_id - Developer identity (SHA1) of extension
development_region - keyword, text.text
- apps.development_region - Info properties CFBundleDevelopmentRegion label
- browser_plugins.development_region - Plugin language-localization
device - keyword, text.text
- device_file.device - Absolute file path to device node
- device_firmware.device - The device name
- device_hash.device - Absolute file path to device node
- device_partitions.device - Absolute file path to device node
- disk_events.device - Disk event BSD name
- file.device - Device ID (optional)
- kernel_info.device - Kernel device identifier
- lxd_instance_devices.device - Name of the device
- mounts.device - Mounted device
- process_memory_map.device - MA:MI Major/minor device ID
device_alias - keyword, text.text
- mounts.device_alias - Mounted device alias
device_error_address - keyword, text.text
- memory_error_info.device_error_address - 32 bit physical address of the error relative to the start of the failing memory address, in bytes
device_id - keyword, text.text
- bitlocker_info.device_id - ID of the encrypted drive.
- cpu_info.device_id - The DeviceID of the CPU.
- drivers.device_id - Device ID
- logical_drives.device_id - The drive id, usually the drive name, e.g., C:.
device_locator - keyword, text.text
- memory_devices.device_locator - String number of the string that identifies the physically-labeled socket or board position where the memory device is located
device_name - keyword, text.text
- drivers.device_name - Device name
- md_devices.device_name - md device name
device_path - keyword, text.text
- iokit_devicetree.device_path - Device tree path
device_type - keyword, text.text
- lxd_instance_devices.device_type - Device type
dhcp_enabled - keyword, number.long
- interface_details.dhcp_enabled - If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.
dhcp_lease_expires - keyword, text.text
- interface_details.dhcp_lease_expires - Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.
dhcp_lease_obtained - keyword, text.text
- interface_details.dhcp_lease_obtained - Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server.
dhcp_server - keyword, text.text
- interface_details.dhcp_server - IP address of the dynamic host configuration protocol (DHCP) server.
direction - keyword, text.text
- windows_firewall_rules.direction - Direction of traffic for which the rule applies
directory - keyword, text.text
- extended_attributes.directory - Directory of file(s)
- file.directory - Directory of file(s)
- hash.directory - Must provide a path or directory
- npm_packages.directory - Directory where node_modules are located
- python_packages.directory - Directory where Python modules are located
- users.directory - User’s home directory
disabled - keyword
- browser_plugins.disabled - Is the plugin disabled. 1 = Disabled
- firefox_addons.disabled - 1 If the addon is application-disabled else 0
- launchd.disabled - Skip loading this daemon or agent on boot
- wifi_networks.disabled - 1 if this network is disabled, 0 otherwise
disc_sharing - keyword, number.long
- sharing_preferences.disc_sharing - 1 If CD or DVD sharing is enabled else 0
disconnected - keyword, number.long
- connectivity.disconnected - True if the all interfaces are not connected to any network
discovery_cache_hits - keyword, number.long
- osquery_packs.discovery_cache_hits - The number of times that the discovery query used cached values since the last time the config was reloaded
discovery_executions - keyword, number.long
- osquery_packs.discovery_executions - The number of times that the discovery queries have been executed since the last time the config was reloaded
disk_bytes_read - keyword, number.long
- processes.disk_bytes_read - Bytes read from disk
disk_bytes_written - keyword, number.long
- processes.disk_bytes_written - Bytes written to disk
disk_index - keyword, number.long
- disk_info.disk_index - Physical drive number of the disk.
disk_read - keyword, number.long
- docker_container_stats.disk_read - Total disk read bytes
disk_size - keyword, number.long
- disk_info.disk_size - Size of the disk.
disk_write - keyword, number.long
- docker_container_stats.disk_write - Total disk write bytes
display_id - keyword, text.text
- connected_displays.display_id - The display ID.
display_name - keyword, text.text
- apps.display_name - Info properties CFBundleDisplayName label
- services.display_name - Service Display name
display_type - keyword, text.text
- connected_displays.display_type - The type of display.
dns_domain - keyword, text.text
- interface_details.dns_domain - Organization name followed by a period and an extension that indicates the type of organization, such as microsoft.com.
dns_domain_name - keyword, text.text
- logon_sessions.dns_domain_name - The DNS name for the owner of the logon session.
dns_domain_suffix_search_order - keyword, text.text
- interface_details.dns_domain_suffix_search_order - Array of DNS domain suffixes to be appended to the end of host names during name resolution.
dns_forest_name - keyword, text.text
- ntdomains.dns_forest_name - The name of the root of the DNS tree.
dns_host_name - keyword, text.text
- interface_details.dns_host_name - Host name used to identify the local computer for authentication by some utilities.
dns_server_search_order - keyword, text.text
- interface_details.dns_server_search_order - Array of server IP addresses to be used in querying for DNS servers.
domain - keyword, text.text
- ad_config.domain - Active Directory trust domain
- managed_policies.domain - System or manager-chosen domain key
- preferences.domain - Application ID usually in com.name.product format
domain_controller_address - keyword, text.text
- ntdomains.domain_controller_address - The IP Address of the discovered domain controller..
domain_controller_name - keyword, text.text
- ntdomains.domain_controller_name - The name of the discovered domain controller.
domain_name - keyword, text.text
- ntdomains.domain_name - The name of the domain.
drive_letter - keyword, text.text
- bitlocker_info.drive_letter - Drive letter of the encrypted drive.
- ntfs_journal_events.drive_letter - The drive letter identifying the source journal
drive_name - keyword, text.text
- md_drives.drive_name - Drive device name
driver - keyword, text.text
- docker_container_mounts.driver - Driver providing the mount
- docker_networks.driver - Network driver
- docker_volumes.driver - Volume driver
- hardware_events.driver - Driver claiming the device
- lxd_storage_pools.driver - Storage driver
- pci_devices.driver - PCI Device used driver
- video_info.driver - The driver of the device.
driver_date - keyword, number.long
- video_info.driver_date - The date listed on the installed driver.
driver_key - keyword, text.text
- drivers.driver_key - Driver key
driver_version - keyword, text.text
- video_info.driver_version - The version of the installed driver.
dst_ip - keyword, text.text
- iptables.dst_ip - Destination IP address.
dst_mask - keyword, text.text
- iptables.dst_mask - Destination IP address mask.
dst_port - keyword, text.text
- iptables.dst_port - Protocol destination port(s).
dtime - keyword, number.long
- shared_memory.dtime - Detached time
dump_certificate - keyword, number.long
- curl_certificate.dump_certificate - Set this value to 1 to dump certificate
duration - keyword, number.long
- bpf_process_events.duration - How much time was spent inside the syscall (nsecs)
- bpf_socket_events.duration - How much time was spent inside the syscall (nsecs)
eapi - keyword, number.long
- portage_packages.eapi - The eapi for the ebuild
egid - keyword
- docker_container_processes.egid - Effective group ID
- es_process_events.egid - Effective Group ID of the process
- process_events.egid - Effective group ID at process start
- process_file_events.egid - Effective group ID of the process using the file
- processes.egid - Unsigned effective group ID
eid - keyword, text.text
- apparmor_events.eid - Event ID
- bpf_process_events.eid - Event ID
- bpf_socket_events.eid - Event ID
- disk_events.eid - Event ID
- es_process_events.eid - Event ID
- es_process_file_events.eid - Event ID
- file_events.eid - Event ID
- hardware_events.eid - Event ID
- ntfs_journal_events.eid - Event ID
- process_etw_events.eid - Event ID
- process_events.eid - Event ID
- process_file_events.eid - Event ID
- selinux_events.eid - Event ID
- socket_events.eid - Event ID
- syslog_events.eid - Event ID
- user_events.eid - Event ID
- windows_events.eid - Event ID
- yara_events.eid - Event ID
ejectable - keyword, number.long
- disk_events.ejectable - 1 if ejectable, 0 if not
elapsed_time - keyword, number.long
- processes.elapsed_time - Elapsed time in seconds this process has been running.
element - keyword, text.text
- apps.element - Does the app identify as a background agent
elevated_token - keyword, number.long
- processes.elevated_token - Process uses elevated token yes=1, no=0
enable_admin_account - keyword, number.long
- security_profile_info.enable_admin_account - Determines whether the Administrator account on the local computer is enabled
enable_guest_account - keyword, number.long
- security_profile_info.enable_guest_account - Determines whether the Guest account on the local computer is enabled
enable_ipv6 - keyword, number.long
- docker_networks.enable_ipv6 - 1 if IPv6 is enabled on this network. 0 otherwise
enabled - keyword
- app_schemes.enabled - 1 if this handler is the OS default, else 0
- event_taps.enabled - Is the Event Tap enabled
- interface_details.enabled - Indicates whether the adapter is enabled or not.
- location_services.enabled - 1 if Location Services are enabled, else 0
- lxd_cluster.enabled - Whether clustering enabled (1) or not (0) on this node
- sandboxes.enabled - Application sandboxings enabled on container
- scheduled_tasks.enabled - Whether or not the scheduled task is enabled
- screenlock.enabled - 1 If a password is required after sleep or the screensaver begins; else 0
- sip_config.enabled - 1 if this configuration is enabled, otherwise 0
- tpm_info.enabled - TPM is enabled
- windows_firewall_rules.enabled - 1 if the rule is enabled
- yum_sources.enabled - Whether the repository is used
enabled_nvram - keyword, number.long
- sip_config.enabled_nvram - 1 if this configuration is enabled, otherwise 0
encrypted - keyword, number.long
- disk_encryption.encrypted - 1 If encrypted: true (disk is encrypted), else 0
- user_ssh_keys.encrypted - 1 if key is encrypted, 0 otherwise
encryption - keyword, text.text
- time_machine_destinations.encryption - Last known encrypted state
encryption_method - keyword, text.text
- bitlocker_info.encryption_method - The encryption type of the device.
encryption_status - keyword, text.text
- disk_encryption.encryption_status - Disk encryption status with one of following values: encrypted | not encrypted | undefined
end - keyword, text.text
- memory_map.end - End address of memory region
- process_memory_map.end - Virtual end address (hex)
ending_address - keyword, text.text
- memory_array_mapped_addresses.ending_address - Physical ending address of last kilobyte of a range of memory mapped to physical memory array
- memory_device_mapped_addresses.ending_address - Physical ending address of last kilobyte of a range of memory mapped to physical memory array
endpoint_id - keyword, text.text
- docker_container_networks.endpoint_id - Endpoint ID
entry - keyword, text.text
- authorization_mechanisms.entry - The whole string entry
- shimcache.entry - Execution order.
env - keyword, text.text
- es_process_events.env - Environment variables delimited by spaces
- process_events.env - Environment variables delimited by spaces
env_count - keyword, number.long
- es_process_events.env_count - Number of environment variables
- process_events.env_count - Number of environment variables
env_size - keyword, number.long
- process_events.env_size - Actual size (bytes) of environment list
env_variables - keyword, text.text
- docker_containers.env_variables - Container environmental variables
environment - keyword, text.text
- apps.environment - Application-set environment variables
ephemeral - keyword, number.long
- lxd_instances.ephemeral - Whether the instance is ephemeral(1) or not(0)
epoch - keyword, number.long
- rpm_packages.epoch - Package epoch value
error - keyword, text.text
- apparmor_events.error - Error information
error_granularity - keyword, text.text
- memory_error_info.error_granularity - Granularity to which the error can be resolved
error_operation - keyword, text.text
- memory_error_info.error_operation - Memory access operation that caused the error
error_resolution - keyword, text.text
- memory_error_info.error_resolution - Range, in bytes, within which this error can be determined, when an error address is given
error_type - keyword, text.text
- memory_error_info.error_type - type of error associated with current error status for array or device
euid - keyword
- docker_container_processes.euid - Effective user ID
- es_process_events.euid - Effective User ID of the process
- process_events.euid - Effective user ID at process start
- process_file_events.euid - Effective user ID of the process using the file
- processes.euid - Unsigned effective user ID
event - keyword, text.text
- crontab.event - The job @event name (rare)
event_queue - keyword, number.long
- carbon_black_info.event_queue - Size in bytes of Carbon Black event files on disk
event_tap_id - keyword, number.long
- event_taps.event_tap_id - Unique ID for the Tap
event_tapped - keyword, text.text
- event_taps.event_tapped - The mask that identifies the set of events to be observed.
event_type - keyword, text.text
- es_process_events.event_type - Type of EndpointSecurity event
- es_process_file_events.event_type - Type of EndpointSecurity event
eventid - keyword, number.long
- windows_eventlog.eventid - Event ID of the event
- windows_events.eventid - Event ID of the event
events - keyword, number.long
- osquery_events.events - Number of events emitted or received since osquery started
exception_address - keyword, text.text
- windows_crashes.exception_address - Address (in hex) where the exception occurred
exception_code - keyword, text.text
- windows_crashes.exception_code - The Windows exception code
exception_codes - keyword, text.text
- crashes.exception_codes - Exception codes from the crash
exception_message - keyword, text.text
- windows_crashes.exception_message - The NTSTATUS error message associated with the exception code
exception_notes - keyword, text.text
- crashes.exception_notes - Exception notes from the crash
exception_type - keyword, text.text
- crashes.exception_type - Exception type of the crash
exe - keyword, text.text
- seccomp_events.exe - The path to the executable that was used to invoke the analyzed process
executable - keyword, text.text
- appcompat_shims.executable - Name of the executable that is being shimmed. This is pulled from the registry.
- process_file_events.executable - The executable path
executable_path - keyword, text.text
- wmi_cli_event_consumers.executable_path - Module to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.
execution_flag - keyword, number.long
- shimcache.execution_flag - Boolean Execution flag, 1 for execution, 0 for no execution, -1 for missing (this flag does not exist on Windows 10 and higher).
executions - keyword, number.long
- osquery_schedule.executions - Number of times the query was executed
exit_code - keyword, text.text
- bpf_process_events.exit_code - Exit code of the system call
- bpf_socket_events.exit_code - Exit code of the system call
- es_process_events.exit_code - Exit code of a process in case of an exit event
- process_etw_events.exit_code - Exit Code - Present only on ProcessStop events
expand - keyword, number.long
- default_environment.expand - 1 if the variable needs expanding, 0 otherwise
expire - keyword, number.long
- shadow.expire - Number of days since UNIX epoch date until account is disabled
expires_at - keyword, text.text
- lxd_images.expires_at - ISO time of image expiration
extended_key_usage - keyword, text.text
- curl_certificate.extended_key_usage - Extended usage of key in certificate
extension_type - keyword, text.text
- safari_extensions.extension_type - Extension Type: WebOrAppExtension or LegacyExtension
extensions - keyword, text.text
- osquery_info.extensions - osquery extensions status
external - keyword, number.long
- app_schemes.external - 1 if this handler does NOT exist on macOS by default, else 0
extra - keyword, text.text
- asl.extra - Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.
- os_version.extra - Optional extra release specification
- platform_info.extra - Platform-specific additional information
facility - keyword, text.text
- asl.facility - Sender’s facility. Default is user.
- syslog_events.facility - Syslog facility
fahrenheit - keyword, number.double
- temperature_sensors.fahrenheit - Temperature in Fahrenheit
failed_disks - keyword, number.long
- md_devices.failed_disks - Number of failed disks in array
failed_login_count - keyword, number.long
- account_policy_data.failed_login_count - The number of failed login attempts using an incorrect password. Count resets after a correct password is entered.
failed_login_timestamp - keyword, number.double
- account_policy_data.failed_login_timestamp - The time of the last failed login attempt. Resets after a correct password is entered
family - keyword, number.long
- bpf_socket_events.family - The Internet protocol family ID
- listening_ports.family - Network protocol (IPv4, IPv6)
- process_open_sockets.family - Network protocol (IPv4, IPv6)
- socket_events.family - The Internet protocol family ID
fan - keyword, text.text
- fan_speed_sensors.fan - Fan number
faults - keyword, number.long
- virtual_memory_info.faults - Total number of calls to vm_faults.
fd - keyword, text.text
- bpf_socket_events.fd - The file description for the process socket
- listening_ports.fd - Socket file descriptor number
- process_open_files.fd - Process-specific file descriptor number
- process_open_pipes.fd - File descriptor
- process_open_sockets.fd - Socket file descriptor number
- socket_events.fd - The file description for the process socket
feature - keyword, text.text
- cpuid.feature - Present feature flags
feature_control - keyword, number.long
- msr.feature_control - Bitfield controlling enabled features.
field_name - keyword, text.text
- system_controls.field_name - Specific attribute of opaque type
file_attributes - keyword, text.text
- ntfs_journal_events.file_attributes - File attributes
file_backed - keyword, number.long
- virtual_memory_info.file_backed - Total number of file backed pages.
file_id - keyword, text.text
- file.file_id - file ID
file_sharing - keyword, number.long
- sharing_preferences.file_sharing - 1 If file sharing is enabled else 0
file_system - keyword, text.text
- logical_drives.file_system - The file system of the drive.
file_version - keyword, text.text
- file.file_version - File version
filename - keyword, text.text
- device_file.filename - Name portion of file path
- es_process_file_events.filename - The source or target filename for the event
- file.filename - Name portion of file path
- lxd_images.filename - Filename of the image file
- prefetch.filename - Executable filename.
- xprotect_entries.filename - Use this file name to match
filepath - keyword, text.text
- package_bom.filepath - Package file or directory
filesystem - keyword, text.text
- disk_events.filesystem - Filesystem if available
filetype - keyword, text.text
- xprotect_entries.filetype - Use this file type to match
filevault_status - keyword, text.text
- disk_encryption.filevault_status - FileVault status with one of following values: on | off | unknown
filter - keyword, text.text
- wmi_filter_consumer_binding.filter - Reference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.
filter_name - keyword, text.text
- iptables.filter_name - Packet matching filter table name.
fingerprint - keyword, text.text
- lxd_certificates.fingerprint - SHA256 hash of the certificate
finished_at - keyword, text.text
- docker_containers.finished_at - Container finish time as string
firewall - keyword, text.text
- windows_security_center.firewall - The health of the monitored Firewall (see windows_security_products)
firewall_unload - keyword, number.long
- alf.firewall_unload - 1 If firewall unloading enabled else 0
firmware_type - keyword, text.text
- platform_info.firmware_type - The type of firmware (uefi, bios, iboot, openfirmware, unknown).
firmware_version - keyword, text.text
- ibridge_info.firmware_version - The build version of the firmware
fix_comments - keyword, text.text
- patches.fix_comments - Additional comments about the patch.
flag - keyword, number.long
- shadow.flag - Reserved
flags - keyword
- device_partitions.flags -
- dns_cache.flags - DNS record flags
- interface_details.flags - Flags (netdevice) for the device
- kernel_keys.flags - A set of flags describing the state of the key.
- mounts.flags - Mounted device flags
- pipes.flags - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes
- process_etw_events.flags - Process Flags
- routes.flags - Flags to describe route
folder_id - keyword, text.text
- ycloud_instance_metadata.folder_id - Folder identifier for the VM
following - keyword, text.text
- systemd_units.following - The name of another unit that this unit follows in state
force_logoff_when_expire - keyword, number.long
- security_profile_info.force_logoff_when_expire - Determines whether SMB client sessions with the SMB server will be forcibly disconnected when the client’s logon hours expire
forced - keyword, number.long
- preferences.forced - 1 if the value is forced/managed, else 0
form_factor - keyword, text.text
- memory_devices.form_factor - Implementation form factor for this memory device
format - keyword, text.text
- cups_jobs.format - The format of the print job
forwarding_enabled - keyword, number.long
- interface_ipv6.forwarding_enabled - Enable IP forwarding
fragment_path - keyword, text.text
- systemd_units.fragment_path - The unit file path this unit was read from, if there is any
frame_backtrace - keyword, text.text
- kernel_panics.frame_backtrace - Backtrace of the crashed module
free - keyword, number.long
- virtual_memory_info.free - Total number of free pages.
free_space - keyword, number.long
- logical_drives.free_space - The amount of free space, in bytes, of the drive (-1 on failure).
friendly_name - keyword, text.text
- interface_addresses.friendly_name - The friendly display name of the interface.
- interface_details.friendly_name - The friendly display name of the interface.
from_webstore - keyword, text.text
- chrome_extensions.from_webstore - True if this extension was installed from the web store
fs_id - keyword, text.text
- quicklook_cache.fs_id - Quicklook file fs_id key
fsgid - keyword
- process_events.fsgid - Filesystem group ID at process start
- process_file_events.fsgid - Filesystem group ID of the process using the file
fsuid - keyword
- apparmor_events.fsuid - Filesystem user ID
- process_events.fsuid - Filesystem user ID at process start
- process_file_events.fsuid - Filesystem user ID of the process using the file
gateway - keyword, text.text
- docker_container_networks.gateway - Gateway
- docker_networks.gateway - Network gateway
- routes.gateway - Route gateway
gid - keyword
- asl.gid - GID that sent the log message (set by the server).
- bpf_process_events.gid - Group ID
- bpf_socket_events.gid - Group ID
- device_file.gid - Owning group ID
- docker_container_processes.gid - Group ID
- es_process_events.gid - Group ID of the process
- file.gid - Owning group ID
- file_events.gid - Owning group ID
- groups.gid - Unsigned int64 group ID
- kernel_keys.gid - The group ID of the key.
- package_bom.gid - Expected group of file or directory
- process_events.gid - Group ID at process start
- process_file_events.gid - The gid of the process performing the action
- processes.gid - Unsigned group ID
- seccomp_events.gid - Group ID of the user who started the analyzed process
- user_groups.gid - Group ID
- users.gid - Group ID (unsigned)
gid_signed - keyword, number.long
- groups.gid_signed - A signed int64 version of gid
- users.gid_signed - Default group ID as int64 signed (Apple)
git_commit - keyword, text.text
- docker_version.git_commit - Docker build git commit
global_seq_num - keyword, number.long
- es_process_events.global_seq_num - Global sequence number
- es_process_file_events.global_seq_num - Global sequence number
global_state - keyword, number.long
- alf.global_state - 1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0
go_version - keyword, text.text
- docker_version.go_version - Go version
gpgcheck - keyword, text.text
- yum_sources.gpgcheck - Whether packages are GPG checked
gpgkey - keyword, text.text
- yum_sources.gpgkey - URL to GPG key
grace_period - keyword, number.long
- screenlock.grace_period - The amount of time in seconds the screen must be asleep or the screensaver on before a password is required on-wake. 0 = immediately; -1 = no password is required on-wake
group_sid - keyword, text.text
- groups.group_sid - Unique group ID
grouping - keyword, text.text
- windows_firewall_rules.grouping - Group to which an individual rule belongs
groupname - keyword, text.text
- groups.groupname - Canonical local group name
- launchd.groupname - Run this daemon or agent as this group
- rpm_package_files.groupname - File default groupname from info DB
- suid_bin.groupname - Binary owner group
guest - keyword, number.long
- cpu_time.guest - Time spent running a virtual CPU for a guest OS under the control of the Linux kernel
guest_nice - keyword, number.long
- cpu_time.guest_nice - Time spent running a niced guest
handle - keyword, text.text
- memory_array_mapped_addresses.handle - Handle, or instance number, associated with the structure
- memory_arrays.handle - Handle, or instance number, associated with the array
- memory_device_mapped_addresses.handle - Handle, or instance number, associated with the structure
- memory_devices.handle - Handle, or instance number, associated with the structure in SMBIOS
- memory_error_info.handle - Handle, or instance number, associated with the structure
- oem_strings.handle - Handle, or instance number, associated with the Type 11 structure
- smbios_tables.handle - Table entry handle
handle_count - keyword, number.long
- processes.handle_count - Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.
handler - keyword, text.text
- app_schemes.handler - Application label for the handler
hard_limit - keyword, text.text
- ulimit_info.hard_limit - Maximum limit value
hard_links - keyword, number.long
- device_file.hard_links - Number of hard links
- file.hard_links - Number of hard links
hardware_model - keyword, text.text
- disk_info.hardware_model - Hard drive model.
- system_info.hardware_model - Hardware model
hardware_serial - keyword, text.text
- system_info.hardware_serial - Device serial number
hardware_vendor - keyword, text.text
- system_info.hardware_vendor - Hardware vendor
hardware_version - keyword, text.text
- system_info.hardware_version - Hardware version
has_expired - keyword, number.long
- curl_certificate.has_expired - 1 if the certificate has expired, 0 otherwise
hash - keyword, text.text
- prefetch.hash - Prefetch CRC hash.
hash_alg - keyword, text.text
- shadow.hash_alg - Password hashing algorithm
hash_resources - keyword, number.long
- signature.hash_resources - Set to 1 to also hash resources, or 0 otherwise. Default is 1
hashed - keyword, number.long
- file_events.hashed - 1 if the file was hashed, 0 if not, -1 if hashing failed
header - keyword, text.text
- sudoers.header - Symbol for given rule
header_pid - keyword, number.long
- process_etw_events.header_pid - Process ID of the process reporting the event
header_size - keyword, number.long
- smbios_tables.header_size - Header size in bytes
health - keyword, text.text
- battery.health - One of the following: "Good" describes a well-performing battery, "Fair" describes a functional battery with limited capacity, or "Poor" describes a battery that’s not capable of providing power
hidden - keyword, number.long
- scheduled_tasks.hidden - Whether or not the task is visible in the UI
- smc_keys.hidden - 1 if this key is normally hidden, otherwise 0
history_file - keyword, text.text
- shell_history.history_file - Path to the .*_history for this user
hit_count - keyword, text.text
- quicklook_cache.hit_count - Number of cache hits on thumbnail
home_directory - keyword, text.text
- logon_sessions.home_directory - The home directory for the logon session.
home_directory_drive - keyword, text.text
- logon_sessions.home_directory_drive - The drive location of the home directory of the logon session.
homepage - keyword, text.text
- atom_packages.homepage - Package supplied homepage
- npm_packages.homepage - Package supplied homepage
hop_limit - keyword, number.long
- interface_ipv6.hop_limit - Current Hop Limit
hopcount - keyword, number.long
- routes.hopcount - Max hops expected
host - keyword, text.text
- asl.host - Sender’s address (set by the server).
- last.host - Entry hostname
- logged_in_users.host - Remote hostname
- preferences.host - current or any host, where current takes precedence
- syslog_events.host - Hostname configured for syslog
host_ip - keyword, text.text
- docker_container_ports.host_ip - Host IP address on which public port is listening
host_port - keyword, number.long
- docker_container_ports.host_port - Host port
hostname - keyword, text.text
- curl_certificate.hostname - Hostname to CURL (domain[:port], e.g. osquery.io)
- system_info.hostname - Network hostname including domain
- ycloud_instance_metadata.hostname - Hostname of the VM
hostnames - keyword, text.text
- etc_hosts.hostnames - Raw hosts mapping
hotfix_id - keyword, text.text
- patches.hotfix_id - The KB ID of the patch.
hour - keyword, text.text
- crontab.hour - The hour of the day for the job
- time.hour - Current hour in UTC
hours - keyword, number.long
- uptime.hours - Hours of uptime
hresult - keyword, number.long
- windows_update_history.hresult - HRESULT value that is returned from the operation on an update
http_proxy - keyword, text.text
- docker_info.http_proxy - HTTP proxy
https_proxy - keyword, text.text
- docker_info.https_proxy - HTTPS proxy
hwaddr - keyword, text.text
- lxd_networks.hwaddr - Hardware address for this network
iam_arn - keyword, text.text
- ec2_instance_metadata.iam_arn - If there is an IAM role associated with the instance, contains instance profile ARN
ibrs_support_enabled - keyword, number.long
- kva_speculative_info.ibrs_support_enabled - Windows uses IBRS.
ibytes - keyword, number.long
- interface_details.ibytes - Input bytes
icmp_types_codes - keyword, text.text
- windows_firewall_rules.icmp_types_codes - ICMP types and codes for the rule
icon_mode - keyword, number.long
- quicklook_cache.icon_mode - Thumbnail icon mode
id - keyword, text.text
- disk_info.id - The unique identifier of the drive on the system.
- dns_resolvers.id - Address type index or order
- docker_container_envs.id - Container ID
- docker_container_fs_changes.id - Container ID
- docker_container_labels.id - Container ID
- docker_container_mounts.id - Container ID
- docker_container_networks.id - Container ID
- docker_container_ports.id - Container ID
- docker_container_processes.id - Container ID
- docker_container_stats.id - Container ID
- docker_containers.id - Container ID
- docker_image_history.id - Image ID
- docker_image_labels.id - Image ID
- docker_image_layers.id - Image ID
- docker_images.id - Image ID
- docker_info.id - Docker system ID
- docker_network_labels.id - Network ID
- docker_networks.id - Network ID
- iokit_devicetree.id - IOKit internal registry ID
- iokit_registry.id - IOKit internal registry ID
- lxd_images.id - Image ID
- systemd_units.id - Unique unit identifier
identifier - keyword, text.text
- browser_plugins.identifier - Plugin identifier
- chrome_extension_content_scripts.identifier - Extension identifier
- chrome_extensions.identifier - Extension identifier, computed from its manifest. Empty in case of error.
- crashes.identifier - Identifier of the crashed process
- firefox_addons.identifier - Addon identifier
- safari_extensions.identifier - Extension identifier
- signature.identifier - The signing identifier sealed into the signature
- system_extensions.identifier - Identifier name
- xprotect_meta.identifier - Browser plugin or extension identifier
identifying_number - keyword, text.text
- programs.identifying_number - Product identification such as a serial number on software, or a die number on a hardware chip.
identity - keyword, text.text
- xprotect_entries.identity - XProtect identity (SHA1) of content
idle - keyword, number.long
- cpu_time.idle - Time spent in the idle task
idrops - keyword, number.long
- interface_details.idrops - Input drops
idx - keyword, number.long
- kernel_extensions.idx - Extension load tag or index
ierrors - keyword, number.long
- interface_details.ierrors - Input errors
image - keyword, text.text
- docker_containers.image - Docker image (name) used to launch this container
- drivers.image - Path to driver image file
image_id - keyword, text.text
- docker_containers.image_id - Docker image ID
images - keyword, number.long
- docker_info.images - Number of images
inactive - keyword, number.long
- memory_info.inactive - The total amount of buffer or page cache memory, in bytes, that are free and available
- shadow.inactive - Number of days after password expires until account is blocked
- virtual_memory_info.inactive - Total number of inactive pages.
inetd_compatibility - keyword, text.text
- launchd.inetd_compatibility - Run this daemon or agent as it was launched from inetd
inf - keyword, text.text
- drivers.inf - Associated inf file
info - keyword, text.text
- apparmor_events.info - Additional information
info_access - keyword, text.text
- curl_certificate.info_access - Authority Information Access
info_string - keyword, text.text
- apps.info_string - Info properties CFBundleGetInfoString label
inherited_from - keyword, text.text
- ntfs_acl_permissions.inherited_from - The inheritance policy of the ACE.
iniface - keyword, text.text
- iptables.iniface - Input interface for the rule.
iniface_mask - keyword, text.text
- iptables.iniface_mask - Input interface mask for the rule.
inode - keyword, number.long
- device_file.inode - Filesystem inode number
- device_hash.inode - Filesystem inode number
- file.inode - Filesystem inode number
- file_events.inode - Filesystem inode number
- process_memory_map.inode - Mapped path inode, 0 means uninitialized (BSS)
- process_open_pipes.inode - Pipe inode number
- quicklook_cache.inode - Parsed file ID (inode) from fs_id
inodes - keyword, number.long
- device_partitions.inodes - Number of meta nodes
- mounts.inodes - Mounted device used inodes
inodes_free - keyword, number.long
- mounts.inodes_free - Mounted device free inodes
inodes_total - keyword, number.long
- lxd_storage_pools.inodes_total - Total number of inodes available in this storage pool
inodes_used - keyword, number.long
- lxd_storage_pools.inodes_used - Number of inodes used
input_eax - keyword, text.text
- cpuid.input_eax - Value of EAX used
install_date - keyword
- os_version.install_date - The install date of the OS.
- patches.install_date - Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.
- programs.install_date - Date that this product was installed on the system.
- shared_resources.install_date - Indicates when the object was installed. Lack of a value does not indicate that the object is not installed.
install_location - keyword, text.text
- programs.install_location - The installation location directory of the product.
install_source - keyword, text.text
- programs.install_source - The installation source of the product.
install_time - keyword
- appcompat_shims.install_time - Install time of the SDB
- chrome_extensions.install_time - Extension install time, in its original Webkit format
- package_receipts.install_time - Timestamp of install time
- rpm_packages.install_time - When the package was installed
install_timestamp - keyword, number.long
- chrome_extensions.install_timestamp - Extension install time, converted to unix time
installed_by - keyword, text.text
- patches.installed_by - The system context in which the patch as installed.
installed_on - keyword, text.text
- patches.installed_on - The date when the patch was installed.
installer_name - keyword, text.text
- package_receipts.installer_name - Name of installer process
instance_id - keyword, text.text
- ec2_instance_metadata.instance_id - EC2 instance ID
- ec2_instance_tags.instance_id - EC2 instance ID
- osquery_info.instance_id - Unique, long-lived ID per instance of osquery
- ycloud_instance_metadata.instance_id - Unique identifier for the VM
instance_identifier - keyword, text.text
- hvci_status.instance_identifier - The instance ID of Device Guard.
instance_type - keyword, text.text
- ec2_instance_metadata.instance_type - EC2 instance type
instances - keyword, number.long
- pipes.instances - Number of instances of the named pipe
interface - keyword, text.text
- arp_cache.interface - Interface of the network for the MAC
- interface_addresses.interface - Interface name
- interface_details.interface - Interface name
- interface_ipv6.interface - Interface name
- routes.interface - Route local interface
- wifi_status.interface - Name of the interface
- wifi_survey.interface - Name of the interface
interleave_data_depth - keyword, number.long
- memory_device_mapped_addresses.interleave_data_depth - The max number of consecutive rows from memory device that are accessed in a single interleave transfer; 0 indicates device is non-interleave
interleave_position - keyword, number.long
- memory_device_mapped_addresses.interleave_position - The position of the device in a interleave, i.e. 0 indicates non-interleave, 1 indicates 1st interleave, 2 indicates 2nd interleave, etc.
internal - keyword, number.long
- osquery_registry.internal - 1 If the plugin is internal else 0
internet_settings - keyword, text.text
- windows_security_center.internet_settings - The health of the Internet Settings
internet_sharing - keyword, number.long
- sharing_preferences.internet_sharing - 1 If internet sharing is enabled else 0
interval - keyword, number.long
- docker_container_stats.interval - Difference between read and preread in nano-seconds
- osquery_schedule.interval - The interval in seconds to run this query, not an exact interval
iowait - keyword, number.long
- cpu_time.iowait - Time spent waiting for I/O to complete
ip - keyword, text.text
- seccomp_events.ip - Instruction pointer value
ip_address - keyword, text.text
- docker_container_networks.ip_address - IP address
ip_prefix_len - keyword, number.long
- docker_container_networks.ip_prefix_len - IP subnet prefix length
ipackets - keyword, number.long
- interface_details.ipackets - Input packets
ipc_namespace - keyword, text.text
- docker_containers.ipc_namespace - IPC namespace
- process_namespaces.ipc_namespace - ipc namespace inode
ipv4_address - keyword, text.text
- lxd_networks.ipv4_address - IPv4 address
ipv4_forwarding - keyword, number.long
- docker_info.ipv4_forwarding - 1 if IPv4 forwarding is enabled. 0 otherwise
ipv4_internet - keyword, number.long
- connectivity.ipv4_internet - True if any interface is connected to the Internet via IPv4
ipv4_local_network - keyword, number.long
- connectivity.ipv4_local_network - True if any interface is connected to a routed network via IPv4
ipv4_no_traffic - keyword, number.long
- connectivity.ipv4_no_traffic - True if any interface is connected via IPv4, but has seen no traffic
ipv4_subnet - keyword, number.long
- connectivity.ipv4_subnet - True if any interface is connected to the local subnet via IPv4
ipv6_address - keyword, text.text
- docker_container_networks.ipv6_address - IPv6 address
- lxd_networks.ipv6_address - IPv6 address
ipv6_gateway - keyword, text.text
- docker_container_networks.ipv6_gateway - IPv6 gateway
ipv6_internet - keyword, number.long
- connectivity.ipv6_internet - True if any interface is connected to the Internet via IPv6
ipv6_local_network - keyword, number.long
- connectivity.ipv6_local_network - True if any interface is connected to a routed network via IPv6
ipv6_no_traffic - keyword, number.long
- connectivity.ipv6_no_traffic - True if any interface is connected via IPv6, but has seen no traffic
ipv6_prefix_len - keyword, number.long
- docker_container_networks.ipv6_prefix_len - IPv6 subnet prefix length
ipv6_subnet - keyword, number.long
- connectivity.ipv6_subnet - True if any interface is connected to the local subnet via IPv6
irq - keyword, number.long
- cpu_time.irq - Time spent servicing interrupts
is_active - keyword, number.long
- running_apps.is_active - (DEPRECATED)
is_hidden - keyword, number.long
- groups.is_hidden - IsHidden attribute set in OpenDirectory
- users.is_hidden - IsHidden attribute set in OpenDirectory
iso_8601 - keyword, text.text
- time.iso_8601 - Current time (ISO format) in UTC
issuer - keyword, text.text
- certificates.issuer - Certificate issuer distinguished name (deprecated, use issuer2)
issuer2 - keyword, text.text
- certificates.issuer2 - Certificate issuer distinguished name
issuer_alternative_names - keyword, text.text
- curl_certificate.issuer_alternative_names - Issuer Alternative Name
issuer_common_name - keyword, text.text
- curl_certificate.issuer_common_name - Issuer common name
issuer_name - keyword, text.text
- authenticode.issuer_name - The certificate issuer name
issuer_organization - keyword, text.text
- curl_certificate.issuer_organization - Issuer organization
issuer_organization_unit - keyword, text.text
- curl_certificate.issuer_organization_unit - Issuer organization unit
job_id - keyword, number.long
- systemd_units.job_id - Next queued job id
job_path - keyword, text.text
- systemd_units.job_path - The object path for the job
job_type - keyword, text.text
- systemd_units.job_type - Job type
json_cmdline - keyword, text.text
- bpf_process_events.json_cmdline - Command line arguments, in JSON format
keep_alive - keyword, text.text
- launchd.keep_alive - Should the process be restarted if killed
kernel_memory - keyword, number.long
- docker_info.kernel_memory - 1 if kernel memory limit support is enabled. 0 otherwise
kernel_version - keyword, text.text
- docker_info.kernel_version - Kernel version
- docker_version.kernel_version - Kernel version
- kernel_panics.kernel_version - Version of the system kernel
key - keyword, text.text
- authorized_keys.key - Key encoded as base64
- azure_instance_tags.key - The tag key
- chrome_extensions.key - The extension key, from the manifest file
- docker_container_envs.key - Environment variable name
- docker_container_labels.key - Label key
- docker_image_labels.key - Label key
- docker_network_labels.key - Label key
- docker_volume_labels.key - Label key
- ec2_instance_tags.key - Tag key
- extended_attributes.key - Name of the value generated from the extended attribute
- known_hosts.key - parsed authorized keys line
- launchd_overrides.key - Name of the override key
- lxd_instance_config.key - Configuration parameter name
- lxd_instance_devices.key - Device info param name
- mdls.key - Name of the metadata key
- plist.key - Preference top-level key
- power_sensors.key - The SMC key on macOS
- preferences.key - Preference top-level key
- process_envs.key - Environment variable name
- registry.key - Name of the key to search for
- selinux_settings.key - Key or class name.
- smc_keys.key - 4-character key
- temperature_sensors.key - The SMC key on macOS
key_algorithm - keyword, text.text
- certificates.key_algorithm - Key algorithm used
key_file - keyword, text.text
- authorized_keys.key_file - Path to the authorized_keys file
- known_hosts.key_file - Path to known_hosts file
key_strength - keyword, text.text
- certificates.key_strength - Key size used for RSA/DSA, or curve name
key_type - keyword, text.text
- user_ssh_keys.key_type - The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.
key_usage - keyword, text.text
- certificates.key_usage - Certificate key usage and extended key usage
- curl_certificate.key_usage - Usage of key in certificate
keychain_path - keyword, text.text
- keychain_acls.keychain_path - The path of the keychain
keyword - keyword, text.text
- portage_keywords.keyword - The keyword applied to the package
keywords - keyword, text.text
- windows_eventlog.keywords - A bitmask of the keywords defined in the event
- windows_events.keywords - A bitmask of the keywords defined in the event
kva_shadow_enabled - keyword, number.long
- kva_speculative_info.kva_shadow_enabled - Kernel Virtual Address shadowing is enabled.
kva_shadow_inv_pcid - keyword, number.long
- kva_speculative_info.kva_shadow_inv_pcid - Kernel VA INVPCID is enabled.
kva_shadow_pcid - keyword, number.long
- kva_speculative_info.kva_shadow_pcid - Kernel VA PCID flushing optimization is enabled.
kva_shadow_user_global - keyword, number.long
- kva_speculative_info.kva_shadow_user_global - User pages are marked as global.
label - keyword, text.text
- apparmor_events.label - AppArmor label
- augeas.label - The label of the configuration item
- authorization_mechanisms.label - Label of the authorization right
- authorizations.label - Item name, usually in reverse domain format
- block_devices.label - Block device label string
- device_partitions.label -
- keychain_acls.label - An optional label tag that may be included with the keychain entry
- keychain_items.label - Generic item name
- launchd.label - Daemon or agent service name
- launchd_overrides.label - Daemon or agent service name
- quicklook_cache.label - Parsed version gen field
- sandboxes.label - UTI-format bundle or label ID
language - keyword, text.text
- programs.language - The language of the product.
last_change - keyword, number.long
- interface_details.last_change - Time of last device modification (optional)
- shadow.last_change - Date of last password change (starting from UNIX epoch date)
last_connected - keyword, number.long
- wifi_networks.last_connected - Last time this network was connected to as a unix_time
last_executed - keyword, number.long
- osquery_schedule.last_executed - UNIX time stamp in seconds of the last completed execution
last_execution_time - keyword, number.long
- background_activities_moderator.last_execution_time - Most recent time application was executed.
- userassist.last_execution_time - Most recent time application was executed.
last_hit_date - keyword, number.long
- quicklook_cache.last_hit_date - Apple date format for last thumbnail cache hit
last_loaded - keyword, text.text
- kernel_panics.last_loaded - Last loaded module before panic
last_memory - keyword, number.long
- osquery_schedule.last_memory - Resident memory in bytes left allocated after collecting results of the latest execution
last_opened_time - keyword
- apps.last_opened_time - The time that the app was last used
- office_mru.last_opened_time - Most recent opened time file was opened
last_run_code - keyword, text.text
- scheduled_tasks.last_run_code - Exit status code of the last task run
last_run_message - keyword, text.text
- scheduled_tasks.last_run_message - Exit status message of the last task run
last_run_time - keyword, number.long
- prefetch.last_run_time - Most recent time application was run.
- scheduled_tasks.last_run_time - Timestamp the task last ran
last_system_time - keyword, number.long
- osquery_schedule.last_system_time - System time in milliseconds of the latest execution
last_unloaded - keyword, text.text
- kernel_panics.last_unloaded - Last unloaded module before panic
last_used_at - keyword, text.text
- lxd_images.last_used_at - ISO time for the most recent use of this image in terms of container spawn
last_user_time - keyword, number.long
- osquery_schedule.last_user_time - User time in milliseconds of the latest execution
last_wall_time_ms - keyword, number.long
- osquery_schedule.last_wall_time_ms - Wall time in milliseconds of the latest execution
launch_type - keyword, text.text
- xprotect_entries.launch_type - Launch services content type
layer_id - keyword, text.text
- docker_image_layers.layer_id - Layer ID
layer_order - keyword, number.long
- docker_image_layers.layer_order - Layer Order (1 = base layer)
level - keyword
- asl.level - Log level number. See levels in asl.h.
- unified_log.level - the severity level of the entry
- windows_eventlog.level - Severity level associated with the event
- windows_events.level - The severity level associated with the event
license - keyword, text.text
- atom_packages.license - License for package
- chocolatey_packages.license - License under which package is launched
- npm_packages.license - License under which package is launched
- python_packages.license - License under which package is launched
link_speed - keyword, number.long
- interface_details.link_speed - Interface speed in Mb/s
linked_against - keyword, text.text
- kernel_extensions.linked_against - Indexes of extensions this extension is linked against
load_state - keyword, text.text
- systemd_units.load_state - Reflects whether the unit definition was properly loaded
local_address - keyword, text.text
- bpf_socket_events.local_address - Local address associated with socket
- process_open_sockets.local_address - Socket local address
- socket_events.local_address - Local address associated with socket
local_addresses - keyword, text.text
- windows_firewall_rules.local_addresses - Local addresses for the rule
local_hostname - keyword, text.text
- ec2_instance_metadata.local_hostname - Private IPv4 DNS hostname of the first interface of this instance
- system_info.local_hostname - Local hostname (optional)
local_ipv4 - keyword, text.text
- ec2_instance_metadata.local_ipv4 - Private IPv4 address of the first interface of this instance
local_port - keyword, number.long
- bpf_socket_events.local_port - Local network protocol port number
- process_open_sockets.local_port - Socket local port
- socket_events.local_port - Local network protocol port number
local_ports - keyword, text.text
- windows_firewall_rules.local_ports - Local ports for the rule
local_timezone - keyword, text.text
- time.local_timezone - Current local timezone in of the system
location - keyword, text.text
- azure_instance_metadata.location - Azure Region the VM is running in
- firefox_addons.location - Global, profile location
- memory_arrays.location - Physical location of the memory array
- package_receipts.location - Optional relative install path on volume
lock - keyword, text.text
- chassis_info.lock - If TRUE, the frame is equipped with a lock.
lock_status - keyword, number.long
- bitlocker_info.lock_status - The accessibility status of the drive from Windows.
locked - keyword, number.long
- shared_memory.locked - 1 if segment is locked else 0
lockout_bad_count - keyword, number.long
- security_profile_info.lockout_bad_count - Number of failed logon attempts after which a user account MUST be locked out
log_file_disk_quota_mb - keyword, number.long
- carbon_black_info.log_file_disk_quota_mb - Event file disk quota in MB
log_file_disk_quota_percentage - keyword, number.long
- carbon_black_info.log_file_disk_quota_percentage - Event file disk quota in a percentage
logging_driver - keyword, text.text
- docker_info.logging_driver - Logging driver
logging_enabled - keyword, number.long
- alf.logging_enabled - 1 If logging mode is enabled else 0
logging_option - keyword, number.long
- alf.logging_option - Firewall logging option
logical_processors - keyword, number.long
- cpu_info.logical_processors - The number of logical processors of the CPU.
logon_domain - keyword, text.text
- logon_sessions.logon_domain - The name of the domain used to authenticate the owner of the logon session.
logon_id - keyword, number.long
- logon_sessions.logon_id - A locally unique identifier (LUID) that identifies a logon session.
logon_script - keyword, text.text
- logon_sessions.logon_script - The script used for logging on.
logon_server - keyword, text.text
- logon_sessions.logon_server - The name of the server used to authenticate the owner of the logon session.
logon_sid - keyword, text.text
- logon_sessions.logon_sid - The user’s security identifier (SID).
logon_time - keyword, number.long
- logon_sessions.logon_time - The time the session owner logged on.
logon_to_change_password - keyword, number.long
- security_profile_info.logon_to_change_password - Determines if logon session is required to change the password
logon_type - keyword, text.text
- logon_sessions.logon_type - The logon method.
lsa_anonymous_name_lookup - keyword, number.long
- security_profile_info.lsa_anonymous_name_lookup - Determines if an anonymous user is allowed to query the local LSA policy
mac - keyword, text.text
- arp_cache.mac - MAC address of broadcasted address
- ec2_instance_metadata.mac - MAC address for the first network interface of this EC2 instance
- interface_details.mac - MAC of interface (optional)
mac_address - keyword, text.text
- docker_container_networks.mac_address - MAC address
machine_name - keyword, text.text
- windows_crashes.machine_name - Name of the machine where the crash happened
magic_db_files - keyword, text.text
- magic.magic_db_files - Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc
main - keyword, number.long
- connected_displays.main - If the display is the main display.
maintainer - keyword, text.text
- apt_sources.maintainer - Repository maintainer
- deb_packages.maintainer - Package maintainer
major - keyword, number.long
- os_version.major - Major release version
major_version - keyword, number.long
- windows_crashes.major_version - Windows major version of the machine
managed - keyword, number.long
- lxd_networks.managed - 1 if network created by LXD, 0 otherwise
mandatory_label - keyword, text.text
- process_etw_events.mandatory_label - Primary token mandatory label sid - Present only on ProcessStart events
manifest_hash - keyword, text.text
- chrome_extensions.manifest_hash - The SHA256 hash of the manifest.json file
manifest_json - keyword, text.text
- chrome_extensions.manifest_json - The manifest file of the extension
manual - keyword, number.long
- managed_policies.manual - 1 if policy was loaded manually, otherwise 0
manufacture_date - keyword, number.long
- battery.manufacture_date - The date the battery was manufactured UNIX Epoch
manufactured_week - keyword, number.long
- connected_displays.manufactured_week - The manufacture week of the display. This field is 0 if not supported
manufactured_year - keyword, number.long
- connected_displays.manufactured_year - The manufacture year of the display. This field is 0 if not supported
manufacturer - keyword, text.text
- battery.manufacturer - The battery manufacturer’s name
- chassis_info.manufacturer - The manufacturer of the chassis.
- cpu_info.manufacturer - The manufacturer of the CPU.
- disk_info.manufacturer - The manufacturer of the disk.
- drivers.manufacturer - Device manufacturer
- interface_details.manufacturer - Name of the network adapter’s manufacturer.
- memory_devices.manufacturer - Manufacturer ID string
- video_info.manufacturer - The manufacturer of the gpu.
manufacturer_id - keyword, number.long
- tpm_info.manufacturer_id - TPM manufacturers ID
manufacturer_name - keyword, text.text
- tpm_info.manufacturer_name - TPM manufacturers name
manufacturer_version - keyword, text.text
- tpm_info.manufacturer_version - TPM version
mask - keyword, text.text
- interface_addresses.mask - Interface netmask
- portage_keywords.mask - If the package is masked
match - keyword, text.text
- chrome_extension_content_scripts.match - The pattern that the script is matched against
- iptables.match - Matching rule that applies.
matches - keyword, text.text
- yara.matches - List of YARA matches
- yara_events.matches - List of YARA matches
max - keyword, number.long
- fan_speed_sensors.max - Maximum speed
- shadow.max - Maximum number of days between password changes
max_capacity - keyword, number.long
- battery.max_capacity - The battery’s actual capacity when it is fully charged in mAh
- memory_arrays.max_capacity - Maximum capacity of array in gigabytes
max_clock_speed - keyword, number.long
- cpu_info.max_clock_speed - The maximum possible frequency of the CPU.
max_instances - keyword, number.long
- pipes.max_instances - The maximum number of instances creatable for this pipe
max_results - keyword, number.long
- windows_search.max_results - Maximum number of results returned by windows api, set to -1 for unlimited
max_rows - keyword, number.long
- unified_log.max_rows - the max number of rows returned (defaults to 100)
max_speed - keyword, number.long
- memory_devices.max_speed - Max speed of memory device in megatransfers per second (MT/s)
max_voltage - keyword, number.long
- memory_devices.max_voltage - Maximum operating voltage of device in millivolts
maximum_allowed - keyword, number.long
- shared_resources.maximum_allowed - Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.
maximum_password_age - keyword, number.long
- security_profile_info.maximum_password_age - Determines the maximum number of days that a password can be used before the client requires the user to change it
md5 - keyword, text.text
- acpi_tables.md5 - MD5 hash of table content
- device_hash.md5 - MD5 hash of provided inode data
- file_events.md5 - The MD5 of the file after change
- hash.md5 - MD5 hash of provided filesystem data
- smbios_tables.md5 - MD5 hash of table entry
md_device_name - keyword, text.text
- md_drives.md_device_name - md device name
mdm_managed - keyword, number.long
- system_extensions.mdm_managed - 1 if managed by MDM system extension payload configuration, 0 otherwise
mechanism - keyword, text.text
- authorization_mechanisms.mechanism - Name of the mechanism that will be called
media_name - keyword, text.text
- disk_events.media_name - Disk event media name string
mem - keyword, number.double
- docker_container_processes.mem - Memory utilization as percentage
member_config_description - keyword, text.text
- lxd_cluster.member_config_description - Config description
member_config_entity - keyword, text.text
- lxd_cluster.member_config_entity - Type of configuration parameter for this node
member_config_key - keyword, text.text
- lxd_cluster.member_config_key - Config key
member_config_name - keyword, text.text
- lxd_cluster.member_config_name - Name of configuration parameter
member_config_value - keyword, text.text
- lxd_cluster.member_config_value - Config value
memory - keyword, number.long
- docker_info.memory - Total memory
memory_array_error_address - keyword, text.text
- memory_error_info.memory_array_error_address - 32 bit physical address of the error based on the addressing of the bus to which the memory array is connected
memory_array_handle - keyword, text.text
- memory_array_mapped_addresses.memory_array_handle - Handle of the memory array associated with this structure
memory_array_mapped_address_handle - keyword, text.text
- memory_device_mapped_addresses.memory_array_mapped_address_handle - Handle of the memory array mapped address to which this device range is mapped to
memory_available - keyword, number.long
- memory_info.memory_available - The amount of physical RAM, in bytes, available for starting new applications, without swapping
memory_cached - keyword, number.long
- docker_container_stats.memory_cached - Memory cached
memory_device_handle - keyword, text.text
- memory_device_mapped_addresses.memory_device_handle - Handle of the memory device structure associated with this structure
memory_error_correction - keyword, text.text
- memory_arrays.memory_error_correction - Primary hardware error correction or detection method supported
memory_error_info_handle - keyword, text.text
- memory_arrays.memory_error_info_handle - Handle, or instance number, associated with any error that was detected for the array
memory_free - keyword, number.long
- memory_info.memory_free - The amount of physical RAM, in bytes, left unused by the system
memory_limit - keyword, number.long
- docker_container_stats.memory_limit - Memory limit
- docker_info.memory_limit - 1 if memory limit support is enabled. 0 otherwise
memory_max_usage - keyword, number.long
- docker_container_stats.memory_max_usage - Memory maximum usage
memory_total - keyword, number.long
- memory_info.memory_total - Total amount of physical RAM, in bytes
memory_type - keyword, text.text
- memory_devices.memory_type - Type of memory used
memory_type_details - keyword, text.text
- memory_devices.memory_type_details - Additional details for memory device
memory_usage - keyword, number.long
- docker_container_stats.memory_usage - Memory usage
message - keyword, text.text
- apparmor_events.message - Raw audit message
- asl.message - Message text.
- lxd_cluster_members.message - Message from the node (Online/Offline)
- selinux_events.message - Message
- syslog_events.message - The syslog message
- unified_log.message - composed message
- user_events.message - Message from the event
metadata_endpoint - keyword, text.text
- ycloud_instance_metadata.metadata_endpoint - Endpoint used to fetch VM metadata
method - keyword, text.text
- curl.method - The HTTP method for the request
metric - keyword, number.long
- interface_details.metric - Metric based on the speed of the interface
- routes.metric - Cost of route. Lowest is preferred
metric_name - keyword, text.text
- prometheus_metrics.metric_name - Name of collected Prometheus metric
metric_value - keyword, number.double
- prometheus_metrics.metric_value - Value of collected Prometheus metric
mft_entry - keyword, number.long
- shellbags.mft_entry - Directory master file table entry.
mft_sequence - keyword, number.long
- shellbags.mft_sequence - Directory master file table sequence.
mime_encoding - keyword, text.text
- magic.mime_encoding - MIME encoding data from libmagic
mime_type - keyword, text.text
- magic.mime_type - MIME type data from libmagic
min - keyword, number.long
- fan_speed_sensors.min - Minimum speed
- shadow.min - Minimal number of days between password changes
min_api_version - keyword, text.text
- docker_version.min_api_version - Minimum API version supported
min_version - keyword, text.text
- xprotect_meta.min_version - The minimum allowed plugin version.
min_voltage - keyword, number.long
- memory_devices.min_voltage - Minimum operating voltage of device in millivolts
minimum_password_age - keyword, number.long
- security_profile_info.minimum_password_age - Determines the minimum number of days that a password must be used before the user can change it
minimum_password_length - keyword, number.long
- security_profile_info.minimum_password_length - Determines the least number of characters that can make up a password for a user account
minimum_system_version - keyword, text.text
- apps.minimum_system_version - Minimum version of macOS required for the app to run
minor - keyword, number.long
- os_version.minor - Minor release version
minor_version - keyword, number.long
- windows_crashes.minor_version - Windows minor version of the machine
minute - keyword, text.text
- crontab.minute - The exact minute for the job
minutes - keyword, number.long
- time.minutes - Current minutes in UTC
- uptime.minutes - Minutes of uptime
minutes_to_full_charge - keyword, number.long
- battery.minutes_to_full_charge - The number of minutes until the battery is fully charged. This value is -1 if this time is still being calculated
minutes_until_empty - keyword, number.long
- battery.minutes_until_empty - The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated
mirror - keyword, number.long
- connected_displays.mirror - If the display is mirrored or not. This field is 1 if mirrored and 0 if not mirrored.
mirrorlist - keyword, text.text
- yum_sources.mirrorlist - Mirrorlist URL
mnt_namespace - keyword, text.text
- docker_containers.mnt_namespace - Mount namespace
- process_namespaces.mnt_namespace - mnt namespace inode
mode - keyword, text.text
- apparmor_profiles.mode - How the policy is applied.
- device_file.mode - Permission bits
- docker_container_mounts.mode - Mount options (rw, ro)
- file.mode - Permission bits
- file_events.mode - Permission bits
- package_bom.mode - Expected permissions
- process_events.mode - File mode permissions
- process_open_pipes.mode - Pipe open mode (r/w)
- rpm_package_files.mode - File permissions mode from info DB
- wifi_status.mode - The current operating mode for the Wi-Fi interface
model - keyword, text.text
- battery.model - The battery’s model number
- block_devices.model - Block device model string identifier
- chassis_info.model - The model of the chassis.
- cpu_info.model - The model of the CPU.
- hardware_events.model - Hardware device model
- pci_devices.model - PCI Device model
- usb_devices.model - USB Device model string
- video_info.model - The model of the gpu.
model_id - keyword, text.text
- hardware_events.model_id - Hex encoded Hardware model identifier
- pci_devices.model_id - Hex encoded PCI Device model identifier
- usb_devices.model_id - Hex encoded USB Device model identifier
modified - keyword, text.text
- authorizations.modified - Label top-level key
- keychain_items.modified - Date of last modification
modified_time - keyword, number.long
- package_bom.modified_time - Timestamp the file was installed
- shellbags.modified_time - Directory Modified time.
- shimcache.modified_time - File Modified time.
module - keyword, text.text
- windows_crashes.module - Path of the crashed module within the process
module_backtrace - keyword, text.text
- kernel_panics.module_backtrace - Modules appearing in the crashed module’s backtrace
module_path - keyword, text.text
- services.module_path - Path to ServiceDll
month - keyword, text.text
- crontab.month - The month of the year for the job
- time.month - Current month in UTC
mount_namespace_id - keyword, text.text
- deb_packages.mount_namespace_id - Mount namespace id
- file.mount_namespace_id - Mount namespace id
- hash.mount_namespace_id - Mount namespace id
- npm_packages.mount_namespace_id - Mount namespace id
- os_version.mount_namespace_id - Mount namespace id
- rpm_packages.mount_namespace_id - Mount namespace id
mount_point - keyword, text.text
- docker_volumes.mount_point - Mount point
mountable - keyword, number.long
- disk_events.mountable - 1 if mountable, 0 if not
mtime - keyword
- device_file.mtime - Last modification time
- file.mtime - Last modification time
- file_events.mtime - Last modification time
- gatekeeper_approved_apps.mtime - Last modification time
- process_events.mtime - File modification in UNIX time
- quicklook_cache.mtime - Parsed version date field
- registry.mtime - timestamp of the most recent registry write
mtu - keyword, number.long
- interface_details.mtu - Network MTU
- lxd_networks.mtu - MTU size
- routes.mtu - Maximum Transmission Unit for the route
name - keyword, text.text
- acpi_tables.name - ACPI table name
- ad_config.name - The macOS-specific configuration name
- apparmor_events.name - Process name
- apparmor_profiles.name - Policy name.
- apps.name - Name of the Name.app folder
- apt_sources.name - Repository name
- atom_packages.name - Package display name
- autoexec.name - Name of the program
- azure_instance_metadata.name - Name of the VM
- block_devices.name - Block device name
- browser_plugins.name - Plugin display name
- chocolatey_packages.name - Package display name
- chrome_extensions.name - Extension display name
- connected_displays.name - The name of the display.
- cups_destinations.name - Name of the printer
- deb_packages.name - Package name
- disk_encryption.name - Disk name
- disk_events.name - Disk event name
- disk_info.name - The label of the disk object.
- dns_cache.name - DNS record name
- docker_container_mounts.name - Optional mount name
- docker_container_networks.name - Network name
- docker_container_processes.name - The process path or shorthand argv[0]
- docker_container_stats.name - Container name
- docker_containers.name - Container name
- docker_info.name - Name of the docker host
- docker_networks.name - Network name
- docker_volume_labels.name - Volume name
- docker_volumes.name - Volume name
- etc_protocols.name - Protocol name
- etc_services.name - Service name
- fan_speed_sensors.name - Fan name
- firefox_addons.name - Addon display name
- homebrew_packages.name - Package name
- ie_extensions.name - Extension display name
- iokit_devicetree.name - Device node name
- iokit_registry.name - Default name of the node
- kernel_extensions.name - Extension label
- kernel_modules.name - Module name
- kernel_panics.name - Process name corresponding to crashed thread
- launchd.name - File name of plist (used by launchd)
- lxd_certificates.name - Name of the certificate
- lxd_instance_config.name - Instance name
- lxd_instance_devices.name - Instance name
- lxd_instances.name - Instance name
- lxd_networks.name - Name of the network
- lxd_storage_pools.name - Name of the storage pool
- managed_policies.name - Policy key name
- md_personalities.name - Name of personality supported by kernel
- memory_map.name - Region name
- npm_packages.name - Package display name
- ntdomains.name - The label by which the object is known.
- nvram.name - Variable name
- os_version.name - Distribution or product name
- osquery_events.name - Event publisher or subscriber name
- osquery_extensions.name - Extension’s name
- osquery_flags.name - Flag name
- osquery_packs.name - The given name for this query pack
- osquery_registry.name - Name of the plugin item
- osquery_schedule.name - The given name for this query
- package_install_history.name - Package display name
- physical_disk_performance.name - Name of the physical disk
- pipes.name - Name of the pipe
- power_sensors.name - Name of power source
- processes.name - The process path or shorthand argv[0]
- programs.name - Commonly used product name.
- python_packages.name - Package display name
- registry.name - Name of the registry value entry
- rpm_packages.name - RPM package name
- safari_extensions.name - Extension display name
- scheduled_tasks.name - Name of the scheduled task
- services.name - Service name
- shared_folders.name - The shared name of the folder as it appears to other users
- shared_resources.name - Alias given to a path set up as a share on a computer system running Windows.
- startup_items.name - Name of startup item
- system_controls.name - Full sysctl MIB name
- temperature_sensors.name - Name of temperature source
- windows_firewall_rules.name - Friendly name of the rule
- windows_optional_features.name - Name of the feature
- windows_search.name - The name of the item
- windows_security_products.name - Name of product
- wmi_bios_info.name - Name of the Bios setting
- wmi_cli_event_consumers.name - Unique name of a consumer.
- wmi_event_filters.name - Unique identifier of an event filter.
- wmi_script_event_consumers.name - Unique identifier for the event consumer.
- xprotect_entries.name - Description of XProtected malware
- xprotect_reports.name - Description of XProtected malware
- ycloud_instance_metadata.name - Name of the VM
- yum_sources.name - Repository name
name_constraints - keyword, text.text
- curl_certificate.name_constraints - Name Constraints
namespace - keyword, text.text
- apparmor_events.namespace - AppArmor namespace
native - keyword, number.long
- browser_plugins.native - Plugin requires native execution
net_namespace - keyword, text.text
- docker_containers.net_namespace - Network namespace
- listening_ports.net_namespace - The inode number of the network namespace
- process_namespaces.net_namespace - net namespace inode
- process_open_sockets.net_namespace - The inode number of the network namespace
netmask - keyword, text.text
- dns_resolvers.netmask - Address (sortlist) netmask length
- routes.netmask - Netmask length
network_id - keyword, text.text
- docker_container_networks.network_id - Network ID
network_name - keyword, text.text
- wifi_networks.network_name - Name of the network
- wifi_status.network_name - Name of the network
- wifi_survey.network_name - Name of the network
network_rx_bytes - keyword, number.long
- docker_container_stats.network_rx_bytes - Total network bytes read
network_tx_bytes - keyword, number.long
- docker_container_stats.network_tx_bytes - Total network bytes transmitted
new_administrator_name - keyword, text.text
- security_profile_info.new_administrator_name - Determines the name of the Administrator account on the local computer
new_guest_name - keyword, text.text
- security_profile_info.new_guest_name - Determines the name of the Guest account on the local computer
next_run_time - keyword, number.long
- scheduled_tasks.next_run_time - Timestamp the task is scheduled to run next
nice - keyword, number.long
- cpu_time.nice - Time spent in user mode with low priority (nice)
- docker_container_processes.nice - Process nice level (-20 to 20, default 0)
- processes.nice - Process nice level (-20 to 20, default 0)
no_proxy - keyword, text.text
- docker_info.no_proxy - Comma-separated list of domain extensions proxy should not be used for
node - keyword, text.text
- augeas.node - The node path of the configuration item
node_ref_number - keyword, text.text
- ntfs_journal_events.node_ref_number - The ordinal that associates a journal record with a filename
noise - keyword, number.long
- wifi_status.noise - The current noise measurement (dBm)
- wifi_survey.noise - The current noise measurement (dBm)
not_valid_after - keyword, text.text
- certificates.not_valid_after - Certificate expiration data
not_valid_before - keyword, text.text
- certificates.not_valid_before - Lower bound of valid date
nr_raid_disks - keyword, number.long
- md_devices.nr_raid_disks - Number of partitions or disk devices to comprise the array
ntime - keyword, text.text
- bpf_process_events.ntime - The nsecs uptime timestamp as obtained from BPF
- bpf_socket_events.ntime - The nsecs uptime timestamp as obtained from BPF
num_procs - keyword, number.long
- docker_container_stats.num_procs - Number of processors
number - keyword, number.long
- etc_protocols.number - Protocol number
- oem_strings.number - The string index of the structure
- smbios_tables.number - Table entry number
number_memory_devices - keyword, number.long
- memory_arrays.number_memory_devices - Number of memory devices on array
number_of_cores - keyword, text.text
- cpu_info.number_of_cores - The number of cores of the CPU.
number_of_efficiency_cores - keyword, number.long
- cpu_info.number_of_efficiency_cores - The number of efficiency cores of the CPU. Only available on Apple Silicon
number_of_performance_cores - keyword, number.long
- cpu_info.number_of_performance_cores - The number of performance cores of the CPU. Only available on Apple Silicon
object_name - keyword, text.text
- winbaseobj.object_name - Object Name
object_path - keyword, text.text
- systemd_units.object_path - The object path for this unit
object_type - keyword, text.text
- winbaseobj.object_type - Object Type
obytes - keyword, number.long
- interface_details.obytes - Output bytes
odrops - keyword, number.long
- interface_details.odrops - Output drops
oerrors - keyword, number.long
- interface_details.oerrors - Output errors
offer - keyword, text.text
- azure_instance_metadata.offer - Offer information for the VM image (Azure image gallery VMs only)
offset - keyword, number.long
- device_partitions.offset -
- process_memory_map.offset - Offset into mapped path
oid - keyword, text.text
- system_controls.oid - Control MIB
old_path - keyword, text.text
- ntfs_journal_events.old_path - Old path (renames only)
on_demand - keyword, text.text
- launchd.on_demand - Deprecated key, replaced by keep_alive
on_disk - keyword, number.long
- processes.on_disk - The process path exists yes=1, no=0, unknown=-1
online - keyword, number.long
- connected_displays.online - The online status of the display. This field is 1 if the display is online and 0 if it is offline.
online_cpus - keyword, number.long
- docker_container_stats.online_cpus - Online CPUs
oom_kill_disable - keyword, number.long
- docker_info.oom_kill_disable - 1 if Out-of-memory kill is disabled. 0 otherwise
opackets - keyword, number.long
- interface_details.opackets - Output packets
opaque_version - keyword, text.text
- gatekeeper.opaque_version - Version of Gatekeeper’s gkopaque.bundle
operation - keyword, text.text
- apparmor_events.operation - Permission requested by the process
- process_file_events.operation - Operation type
- windows_update_history.operation - Operation on an update
option - keyword, text.text
- ad_config.option - Canonical name of option
- ssh_configs.option - The option and value
option_name - keyword, text.text
- cups_destinations.option_name - Option name
option_value - keyword, text.text
- cups_destinations.option_value - Option value
optional - keyword, number.long
- xprotect_entries.optional - Match any of the identities/patterns for this XProtect name
optional_permissions - keyword, text.text
- chrome_extensions.optional_permissions - The permissions optionally required by the extensions
optional_permissions_json - keyword, text.text
- chrome_extensions.optional_permissions_json - The JSON-encoded permissions optionally required by the extensions
options - keyword, text.text
- authorized_keys.options - Optional list of login options
- dns_resolvers.options - Resolver options
- nfs_shares.options - Options string set on the export share
organization - keyword, text.text
- curl_certificate.organization - Organization issued to
organization_unit - keyword, text.text
- curl_certificate.organization_unit - Organization unit issued to
original_filename - keyword, text.text
- file.original_filename - (Executable files only) Original filename
original_parent - keyword, number.long
- es_process_events.original_parent - Original parent process ID in case of reparenting
original_program_name - keyword, text.text
- authenticode.original_program_name - The original program name that the publisher has signed
os - keyword, text.text
- docker_info.os - Operating system
- docker_version.os - Operating system
- lxd_images.os - OS on which image is based
- lxd_instances.os - The OS of this instance
os_type - keyword, text.text
- azure_instance_metadata.os_type - Linux or Windows
- docker_info.os_type - Operating system type
os_version - keyword, text.text
- kernel_panics.os_version - Version of the operating system
other - keyword, text.text
- md_devices.other - Other information associated with array from /proc/mdstat
other_run_times - keyword, text.text
- prefetch.other_run_times - Other execution times in prefetch file.
ouid - keyword, number.long
- apparmor_events.ouid - Object owner’s user ID
outiface - keyword, text.text
- iptables.outiface - Output interface for the rule.
outiface_mask - keyword, text.text
- iptables.outiface_mask - Output interface mask for the rule.
output_bit - keyword, number.long
- cpuid.output_bit - Bit in register value for feature value
output_register - keyword, text.text
- cpuid.output_register - Register used to for feature value
output_size - keyword, number.long
- osquery_schedule.output_size - Cumulative total number of bytes generated by the resultant rows of the query
overflows - keyword, text.text
- process_events.overflows - List of structures that overflowed
owned - keyword, number.long
- tpm_info.owned - TPM is owned
owner - keyword, text.text
- windows_search.owner - The owner of the item
owner_gid - keyword, number.long
- process_events.owner_gid - File owner group ID
owner_uid - keyword, number.long
- process_events.owner_uid - File owner user ID
- shared_memory.owner_uid - User ID of owning process
owner_uuid - keyword, number.long
- osquery_registry.owner_uuid - Extension route UUID (0 for core)
package - keyword, text.text
- portage_keywords.package - Package name
- portage_packages.package - Package name
- portage_use.package - Package name
- rpm_package_files.package - RPM package name
package_filename - keyword, text.text
- package_receipts.package_filename - Filename of original .pkg file
package_group - keyword, text.text
- rpm_packages.package_group - Package group
package_id - keyword, text.text
- package_install_history.package_id - Label packageIdentifiers
- package_receipts.package_id - Package domain identifier
packets - keyword, number.long
- iptables.packets - Number of matching packets for this rule.
packets_received - keyword, number.long
- lxd_networks.packets_received - Number of packets received on this network
packets_sent - keyword, number.long
- lxd_networks.packets_sent - Number of packets sent on this network
page_ins - keyword, number.long
- virtual_memory_info.page_ins - The total number of requests for pages from a pager.
page_outs - keyword, number.long
- virtual_memory_info.page_outs - Total number of pages paged out.
parent - keyword
- apparmor_events.parent - Parent process PID
- block_devices.parent - Block device parent name
- bpf_process_events.parent - Parent process ID
- bpf_socket_events.parent - Parent process ID
- crashes.parent - Parent PID of the crashed process
- docker_container_processes.parent - Process parent’s PID
- es_process_events.parent - Parent process ID
- es_process_file_events.parent - Parent process ID
- iokit_devicetree.parent - Parent device registry ID
- iokit_registry.parent - Parent registry ID
- process_events.parent - Process parent’s PID, or -1 if cannot be determined.
- processes.parent - Process parent’s PID
parent_process_sequence_number - keyword, number.long
- process_etw_events.parent_process_sequence_number - Parent Process Sequence Number - Present only on ProcessStart events
parent_ref_number - keyword, text.text
- ntfs_journal_events.parent_ref_number - The ordinal that associates a journal record with a filename’s parent directory
part_number - keyword, text.text
- memory_devices.part_number - Manufacturer specific serial number of memory device
partial - keyword
- ntfs_journal_events.partial - Set to 1 if either path or old_path only contains the file or folder name
- process_file_events.partial - True if this is a partial event (i.e.: this process existed before we started osquery)
partition - keyword, text.text
- device_file.partition - A partition number
- device_hash.partition - A partition number
- device_partitions.partition - A partition number or description
partition_row_position - keyword, number.long
- memory_device_mapped_addresses.partition_row_position - Identifies the position of the referenced memory device in a row of the address partition
partition_width - keyword, number.long
- memory_array_mapped_addresses.partition_width - Number of memory devices that form a single row of memory for the address partition of this structure
partitions - keyword, number.long
- disk_info.partitions - Number of detected partitions on disk.
partner_fd - keyword, number.long
- process_open_pipes.partner_fd - File descriptor of shared pipe at partner’s end
partner_mode - keyword, text.text
- process_open_pipes.partner_mode - Mode of shared pipe at partner’s end
partner_pid - keyword, number.long
- process_open_pipes.partner_pid - Process ID of partner process sharing a particular pipe
passpoint - keyword, number.long
- wifi_networks.passpoint - 1 if Passpoint is supported, 0 otherwise
password_complexity - keyword, number.long
- security_profile_info.password_complexity - Determines whether passwords must meet a series of strong-password guidelines
password_history_size - keyword, number.long
- security_profile_info.password_history_size - Number of unique new passwords that must be associated with a user account before an old password can be reused
password_last_set_time - keyword, number.double
- account_policy_data.password_last_set_time - The time the password was last changed
password_status - keyword, text.text
- shadow.password_status - Password status
patch - keyword, number.long
- os_version.patch - Optional patch release
path - keyword, text.text
- alf_exceptions.path - Path to the executable that is excepted
- apparmor_profiles.path - Unique, aa-status compatible, policy identifier.
- appcompat_shims.path - This is the path to the SDB database.
- apps.path - Absolute and full Name.app path
- atom_packages.path - Package’s package.json path
- augeas.path - The path to the configuration file
- authenticode.path - Must provide a path or directory
- autoexec.path - Path to the executable
- background_activities_moderator.path - Application file path.
- bpf_process_events.path - Binary path
- bpf_socket_events.path - Path of executed file
- browser_plugins.path - Path to plugin bundle
- carves.path - The path of the requested carve
- certificates.path - Path to Keychain or PEM bundle
- chocolatey_packages.path - Path at which this package resides
- chrome_extension_content_scripts.path - Path to extension folder
- chrome_extensions.path - Path to extension folder
- crashes.path - Path to the crashed process
- crontab.path - File parsed
- device_file.path - A logical path within the device node
- disk_events.path - Path of the DMG file accessed
- docker_container_fs_changes.path - FIle or directory path relative to rootfs
- docker_containers.path - Container path
- es_process_events.path - Path of executed file
- es_process_file_events.path - Path of executed file
- extended_attributes.path - Absolute file path
- file.path - Absolute file path
- firefox_addons.path - Path to plugin bundle
- gatekeeper_approved_apps.path - Path of executable allowed to run
- hardware_events.path - Local device path assigned (optional)
- hash.path - Must provide a path or directory
- homebrew_packages.path - Package install path
- ie_extensions.path - Path to executable
- kernel_extensions.path - Optional path to extension bundle
- kernel_info.path - Kernel path
- kernel_panics.path - Location of log file
- keychain_acls.path - The path of the authorized application
- keychain_items.path - Path to keychain containing item
- launchd.path - Path to daemon or agent plist
- launchd_overrides.path - Path to daemon or agent plist
- listening_ports.path - Path for UNIX domain sockets
- magic.path - Absolute path to target file
- mdfind.path - Path of the file returned from spotlight
- mdls.path - Path of the file
- mounts.path - Mounted device path
- npm_packages.path - Path at which this module resides
- ntfs_acl_permissions.path - Path to the file or directory.
- ntfs_journal_events.path - Path
- office_mru.path - File path
- osquery_extensions.path - Path of the extension’s Thrift connection or library path
- package_bom.path - Path of package bom
- package_receipts.path - Path of receipt plist
- plist.path - (required) read preferences from a plist
- prefetch.path - Prefetch file path.
- process_etw_events.path - Path of executed binary
- process_events.path - Path of executed file
- process_file_events.path - The path associated with the event
- process_memory_map.path - Path to mapped file or mapped type
- process_open_files.path - Filesystem path of descriptor
- process_open_sockets.path - For UNIX sockets (family=AF_UNIX), the domain path
- processes.path - Path to executed binary
- python_packages.path - Path at which this module resides
- quicklook_cache.path - Path of file
- registry.path - Full path to the value
- rpm_package_files.path - File path within the package
- safari_extensions.path - Path to extension XAR bundle
- sandboxes.path - Path to sandbox container directory
- scheduled_tasks.path - Path to the executable to be run
- services.path - Path to Service Executable
- shared_folders.path - Absolute path of shared folder on the local system
- shared_resources.path - Local path of the Windows share.
- shellbags.path - Directory name.
- shimcache.path - This is the path to the executed file.
- signature.path - Must provide a path or directory
- socket_events.path - Path of executed file
- startup_items.path - Path of startup item
- suid_bin.path - Binary path
- system_extensions.path - Original path of system extension
- user_events.path - Supplied path from event
- user_ssh_keys.path - Path to key file
- userassist.path - Application file path.
- windows_crashes.path - Path of the executable file for the crashed process
- windows_search.path - The full path of the item.
- yara.path - The path scanned
pci_class - keyword, text.text
- pci_devices.pci_class - PCI Device class
pci_class_id - keyword, text.text
- pci_devices.pci_class_id - PCI Device class ID in hex format
pci_slot - keyword, text.text
- interface_details.pci_slot - PCI slot number
- pci_devices.pci_slot - PCI Device used slot
pci_subclass - keyword, text.text
- pci_devices.pci_subclass - PCI Device subclass
pci_subclass_id - keyword, text.text
- pci_devices.pci_subclass_id - PCI Device subclass in hex format
pem - keyword, text.text
- curl_certificate.pem - Certificate PEM format
percent_disk_read_time - keyword, number.long
- physical_disk_performance.percent_disk_read_time - Percentage of elapsed time that the selected disk drive is busy servicing read requests
percent_disk_time - keyword, number.long
- physical_disk_performance.percent_disk_time - Percentage of elapsed time that the selected disk drive is busy servicing read or write requests
percent_disk_write_time - keyword, number.long
- physical_disk_performance.percent_disk_write_time - Percentage of elapsed time that the selected disk drive is busy servicing write requests
percent_idle_time - keyword, number.long
- physical_disk_performance.percent_idle_time - Percentage of time during the sample interval that the disk was idle
percent_processor_time - keyword, number.long
- processes.percent_processor_time - Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.
percent_remaining - keyword, number.long
- battery.percent_remaining - The percentage of battery remaining before it is drained
percentage_encrypted - keyword, number.long
- bitlocker_info.percentage_encrypted - The percentage of the drive that is encrypted.
perf_ctl - keyword, number.long
- msr.perf_ctl - Performance setting for the processor.
perf_status - keyword, number.long
- msr.perf_status - Performance status for the processor.
period - keyword, text.text
- load_average.period - Period over which the average is calculated.
permanent - keyword, text.text
- arp_cache.permanent - 1 for true, 0 for false
permissions - keyword, text.text
- chrome_extensions.permissions - The permissions required by the extension
- kernel_keys.permissions - The key permissions, expressed as four hexadecimalbytes containing, from left to right, thepossessor, user, group, and other permissions.
- process_memory_map.permissions - r=read, w=write, x=execute, p=private (cow)
- shared_memory.permissions - Memory segment permissions
- suid_bin.permissions - Binary permissions
permissions_json - keyword, text.text
- chrome_extensions.permissions_json - The JSON-encoded permissions required by the extension
persistent - keyword, number.long
- chrome_extensions.persistent - 1 If extension is persistent across all tabs else 0
persistent_volume_id - keyword, text.text
- bitlocker_info.persistent_volume_id - Persistent ID of the drive.
personal_hotspot - keyword, number.long
- wifi_networks.personal_hotspot - 1 if this network is a personal hotspot, 0 otherwise
pgroup - keyword, number.long
- docker_container_processes.pgroup - Process group
- processes.pgroup - Process group
physical_adapter - keyword, number.long
- interface_details.physical_adapter - Indicates whether the adapter is a physical or a logical adapter.
physical_memory - keyword, number.long
- system_info.physical_memory - Total physical memory in bytes
physical_presence_version - keyword, text.text
- tpm_info.physical_presence_version - Version of the Physical Presence Interface
pid - keyword, number.long
- apparmor_events.pid - Process ID
- asl.pid - Sending process ID encoded as a string. Set automatically.
- bpf_process_events.pid - Process ID
- bpf_socket_events.pid - Process ID
- crashes.pid - Process (or thread) ID of the crashed process
- docker_container_processes.pid - Process ID
- docker_containers.pid - Identifier of the initial process
- es_process_events.pid - Process (or thread) ID
- es_process_file_events.pid - Process (or thread) ID
- last.pid - Process (or thread) ID
- listening_ports.pid - Process (or thread) ID
- logged_in_users.pid - Process (or thread) ID
- lxd_instances.pid - Instance’s process ID
- osquery_info.pid - Process (or thread/handle) ID
- pipes.pid - Process ID of the process to which the pipe belongs
- process_envs.pid - Process (or thread) ID
- process_etw_events.pid - Process ID
- process_events.pid - Process (or thread) ID
- process_file_events.pid - Process ID
- process_memory_map.pid - Process (or thread) ID
- process_namespaces.pid - Process (or thread) ID
- process_open_files.pid - Process (or thread) ID
- process_open_pipes.pid - Process ID
- process_open_sockets.pid - Process (or thread) ID
- processes.pid - Process (or thread) ID
- running_apps.pid - The pid of the application
- seccomp_events.pid - Process ID
- services.pid - the Process ID of the service
- shared_memory.pid - Process ID to last use the segment
- socket_events.pid - Process (or thread) ID
- unified_log.pid - the pid of the process that made the entry
- user_events.pid - Process (or thread) ID
- windows_crashes.pid - Process ID of the crashed process
- windows_eventlog.pid - Process ID which emitted the event record
pid_namespace - keyword, text.text
- docker_containers.pid_namespace - PID namespace
- process_namespaces.pid_namespace - pid namespace inode
pid_with_namespace - keyword, number.long
- apt_sources.pid_with_namespace - Pids that contain a namespace
- authorized_keys.pid_with_namespace - Pids that contain a namespace
- crontab.pid_with_namespace - Pids that contain a namespace
- deb_packages.pid_with_namespace - Pids that contain a namespace
- dns_resolvers.pid_with_namespace - Pids that contain a namespace
- etc_hosts.pid_with_namespace - Pids that contain a namespace
- file.pid_with_namespace - Pids that contain a namespace
- groups.pid_with_namespace - Pids that contain a namespace
- hash.pid_with_namespace - Pids that contain a namespace
- npm_packages.pid_with_namespace - Pids that contain a namespace
- os_version.pid_with_namespace - Pids that contain a namespace
- python_packages.pid_with_namespace - Pids that contain a namespace
- rpm_packages.pid_with_namespace - Pids that contain a namespace
- suid_bin.pid_with_namespace - Pids that contain a namespace
- user_ssh_keys.pid_with_namespace - Pids that contain a namespace
- users.pid_with_namespace - Pids that contain a namespace
- yara.pid_with_namespace - Pids that contain a namespace
- yum_sources.pid_with_namespace - Pids that contain a namespace
pids - keyword, number.long
- docker_container_stats.pids - Number of processes
pixels - keyword, text.text
- connected_displays.pixels - The number of pixels of the display.
pk_hash - keyword, text.text
- keychain_items.pk_hash - Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2)
placement_group_id - keyword, text.text
- azure_instance_metadata.placement_group_id - Placement group for the VM scale set
platform - keyword, text.text
- os_version.platform - OS Platform or ID
- osquery_packs.platform - Platforms this query is supported on
platform_binary - keyword, number.long
- es_process_events.platform_binary - Indicates if the binary is Apple signed binary (1) or not (0)
platform_fault_domain - keyword, text.text
- azure_instance_metadata.platform_fault_domain - Fault domain the VM is running in
platform_info - keyword, number.long
- msr.platform_info - Platform information.
platform_like - keyword, text.text
- os_version.platform_like - Closely related platforms
platform_mask - keyword, number.long
- osquery_info.platform_mask - The osquery platform bitmask
platform_update_domain - keyword, text.text
- azure_instance_metadata.platform_update_domain - Update domain the VM is running in
plugin - keyword, text.text
- authorization_mechanisms.plugin - Authorization plugin name
pnp_device_id - keyword, text.text
- disk_info.pnp_device_id - The unique identifier of the drive on the system.
point_to_point - keyword, text.text
- interface_addresses.point_to_point - PtP address for the interface
policies - keyword, text.text
- curl_certificate.policies - Certificate Policies
policy - keyword, text.text
- iptables.policy - Policy that applies for this rule.
policy_constraints - keyword, text.text
- curl_certificate.policy_constraints - Policy Constraints
policy_content - keyword, text.text
- password_policy.policy_content - Policy content
policy_description - keyword, text.text
- password_policy.policy_description - Policy description
policy_identifier - keyword, text.text
- password_policy.policy_identifier - Policy Identifier
policy_mappings - keyword, text.text
- curl_certificate.policy_mappings - Policy Mappings
port - keyword, number.long
- docker_container_ports.port - Port inside the container
- etc_services.port - Service port number
- listening_ports.port - Transport layer port
possibly_hidden - keyword, number.long
- wifi_networks.possibly_hidden - 1 if network is possibly a hidden network, 0 otherwise
ppid - keyword, number.long
- process_etw_events.ppid - Parent Process ID
- process_file_events.ppid - Parent process ID
pre_cpu_kernelmode_usage - keyword, number.long
- docker_container_stats.pre_cpu_kernelmode_usage - Last read CPU kernel mode usage
pre_cpu_total_usage - keyword, number.long
- docker_container_stats.pre_cpu_total_usage - Last read total CPU usage
pre_cpu_usermode_usage - keyword, number.long
- docker_container_stats.pre_cpu_usermode_usage - Last read CPU user mode usage
pre_online_cpus - keyword, number.long
- docker_container_stats.pre_online_cpus - Last read online CPUs
pre_system_cpu_usage - keyword, number.long
- docker_container_stats.pre_system_cpu_usage - Last read CPU system usage
predicate - keyword, text.text
-
unified_log.predicate - predicate to search (see
log help predicates), note that this is merged into the predicate created from the column constraints
prefix - keyword, text.text
- homebrew_packages.prefix - Homebrew install prefix
preread - keyword, number.long
- docker_container_stats.preread - UNIX time when stats were last read
principal - keyword, text.text
- ntfs_acl_permissions.principal - User or group to which the ACE applies.
printer_sharing - keyword, number.long
- sharing_preferences.printer_sharing - 1 If printer sharing is enabled else 0
priority - keyword, text.text
- deb_packages.priority - Package priority
privileged - keyword, text.text
- authorization_mechanisms.privileged - If privileged it will run as root, else as an anonymous user
- docker_containers.privileged - Is the container privileged
probe_error - keyword, number.long
- bpf_process_events.probe_error - Set to 1 if one or more buffers could not be captured
- bpf_socket_events.probe_error - Set to 1 if one or more buffers could not be captured
process - keyword, text.text
- alf_explicit_auths.process - Process name explicitly allowed
- unified_log.process - the name of the process that made the entry
process_being_tapped - keyword, number.long
- event_taps.process_being_tapped - The process ID of the target application
process_sequence_number - keyword, number.long
- process_etw_events.process_sequence_number - Process Sequence Number - Present only on ProcessStart events
process_type - keyword, text.text
- launchd.process_type - Key describes the intended purpose of the job
process_uptime - keyword, number.long
- windows_crashes.process_uptime - Uptime of the process in seconds
processes - keyword, number.long
- lxd_instances.processes - Number of processes running inside this instance
processing_time - keyword, number.long
- cups_jobs.processing_time - How long the job took to process
processor_number - keyword, number.long
- msr.processor_number - The processor number as reported in /proc/cpuinfo
processor_type - keyword, text.text
- cpu_info.processor_type - The processor type, such as Central, Math, or Video.
product_id - keyword, text.text
- connected_displays.product_id - The product ID of the display.
product_name - keyword, text.text
- tpm_info.product_name - Product name of the TPM
product_version - keyword, text.text
- file.product_version - File product version
profile - keyword, text.text
- apparmor_events.profile - Apparmor profile name
- chrome_extensions.profile - The name of the Chrome profile that contains this extension
profile_domain - keyword, number.long
- windows_firewall_rules.profile_domain - 1 if the rule profile type is domain
profile_path - keyword, text.text
- chrome_extension_content_scripts.profile_path - The profile path
- chrome_extensions.profile_path - The profile path
- logon_sessions.profile_path - The home directory for the logon session.
profile_private - keyword, number.long
- windows_firewall_rules.profile_private - 1 if the rule profile type is private
profile_public - keyword, number.long
- windows_firewall_rules.profile_public - 1 if the rule profile type is public
program - keyword, text.text
- launchd.program - Path to target program
program_arguments - keyword, text.text
- launchd.program_arguments - Command line arguments passed to program
propagation - keyword, text.text
- docker_container_mounts.propagation - Mount propagation
properties - keyword, text.text
- windows_search.properties - Additional property values JSON
protected - keyword, number.long
- app_schemes.protected - 1 if this handler is protected (reserved) by macOS, else 0
protection_disabled - keyword, number.long
- carbon_black_info.protection_disabled - If the sensor is configured to report tamper events
protection_status - keyword, number.long
- bitlocker_info.protection_status - The bitlocker protection status of the drive.
protection_type - keyword, text.text
- processes.protection_type - The protection type of the process
protocol - keyword
- bpf_socket_events.protocol - The network protocol ID
- etc_services.protocol - Transport protocol (TCP/UDP)
- iptables.protocol - Protocol number identification.
- listening_ports.protocol - Transport protocol (TCP/UDP)
- process_open_sockets.protocol - Transport protocol (TCP/UDP)
- socket_events.protocol - The network protocol ID
- usb_devices.protocol - USB Device protocol
- windows_firewall_rules.protocol - IP protocol of the rule
provider - keyword, text.text
- drivers.provider - Driver provider
provider_guid - keyword, text.text
- windows_eventlog.provider_guid - Provider guid of the event
- windows_events.provider_guid - Provider guid of the event
provider_name - keyword, text.text
- windows_eventlog.provider_name - Provider name of the event
- windows_events.provider_name - Provider name of the event
pseudo - keyword, number.long
- process_memory_map.pseudo - 1 If path is a pseudo path, else 0
public - keyword, number.long
- lxd_images.public - Whether image is public (1) or not (0)
publisher - keyword, text.text
- azure_instance_metadata.publisher - Publisher of the VM image
- osquery_events.publisher - Name of the associated publisher
- programs.publisher - Name of the product supplier.
purgeable - keyword, number.long
- virtual_memory_info.purgeable - Total number of purgeable pages.
purged - keyword, number.long
- virtual_memory_info.purged - Total number of purged pages.
query - keyword, text.text
- mdfind.query - The query that was run to find the file
- osquery_schedule.query - The exact query to run
- windows_search.query - Windows search query
- wmi_event_filters.query - Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.
query_language - keyword, text.text
- wmi_event_filters.query_language - Query language that the query is written in.
queue_directories - keyword, text.text
- launchd.queue_directories - Similar to watch_paths but only with non-empty directories
raid_disks - keyword, number.long
- md_devices.raid_disks - Number of configured RAID disks in array
raid_level - keyword, number.long
- md_devices.raid_level - Current raid level of the array
rapl_energy_status - keyword, number.long
- msr.rapl_energy_status - Run Time Average Power Limiting energy status.
rapl_power_limit - keyword, number.long
- msr.rapl_power_limit - Run Time Average Power Limiting power limit.
rapl_power_units - keyword, number.long
- msr.rapl_power_units - Run Time Average Power Limiting power units.
reactivated - keyword, number.long
- virtual_memory_info.reactivated - Total number of reactivated pages.
read - keyword, number.long
- docker_container_stats.read - UNIX time when stats were read
readonly - keyword, number.long
- nfs_shares.readonly - 1 if the share is exported readonly else 0
readonly_rootfs - keyword, number.long
- docker_containers.readonly_rootfs - Is the root filesystem mounted as read only
record_timestamp - keyword, text.text
- ntfs_journal_events.record_timestamp - Journal record timestamp
record_usn - keyword, text.text
- ntfs_journal_events.record_usn - The update sequence number that identifies the journal record
recovery_finish - keyword, text.text
- md_devices.recovery_finish - Estimated duration of recovery activity
recovery_progress - keyword, text.text
- md_devices.recovery_progress - Progress of the recovery activity
recovery_speed - keyword, text.text
- md_devices.recovery_speed - Speed of recovery activity
redirect_accept - keyword, number.long
- interface_ipv6.redirect_accept - Accept ICMP redirect messages
ref_pid - keyword, number.long
- asl.ref_pid - Reference PID for messages proxied by launchd
ref_proc - keyword, text.text
- asl.ref_proc - Reference process for messages proxied by launchd
referenced - keyword, number.long
- chrome_extension_content_scripts.referenced - 1 if this extension is referenced by the Preferences file of the profile
- chrome_extensions.referenced - 1 if this extension is referenced by the Preferences file of the profile
referenced_identifier - keyword, text.text
- chrome_extensions.referenced_identifier - Extension identifier, as specified by the preferences file. Empty if the extension is not in the profile.
refreshes - keyword, number.long
- osquery_events.refreshes - Publisher only: number of runloop restarts
refs - keyword, number.long
- kernel_extensions.refs - Reference count
region - keyword, text.text
- ec2_instance_metadata.region - AWS region in which this instance launched
registers - keyword, text.text
- crashes.registers - The value of the system registers
- kernel_panics.registers - A space delimited line of register:value pairs
- windows_crashes.registers - The values of the system registers
registry - keyword, text.text
- osquery_registry.registry - Name of the osquery registry
registry_hive - keyword, text.text
- logged_in_users.registry_hive - HKEY_USERS registry hive
registry_path - keyword, text.text
- ie_extensions.registry_path - Extension identifier
relative_path - keyword, text.text
- wmi_cli_event_consumers.relative_path - Relative path to the class or instance.
- wmi_event_filters.relative_path - Relative path to the class or instance.
- wmi_filter_consumer_binding.relative_path - Relative path to the class or instance.
- wmi_script_event_consumers.relative_path - Relative path to the class or instance.
release - keyword, text.text
- apt_sources.release - Release name
- lxd_images.release - OS release version on which the image is based
- rpm_packages.release - Package release
remediation_path - keyword, text.text
- windows_security_products.remediation_path - Remediation path
remote_address - keyword, text.text
- bpf_socket_events.remote_address - Remote address associated with socket
- process_open_sockets.remote_address - Socket remote address
- socket_events.remote_address - Remote address associated with socket
remote_addresses - keyword, text.text
- windows_firewall_rules.remote_addresses - Remote addresses for the rule
remote_apple_events - keyword, number.long
- sharing_preferences.remote_apple_events - 1 If remote apple events are enabled else 0
remote_login - keyword, number.long
- sharing_preferences.remote_login - 1 If remote login is enabled else 0
remote_management - keyword, number.long
- sharing_preferences.remote_management - 1 If remote management is enabled else 0
remote_port - keyword, number.long
- bpf_socket_events.remote_port - Remote network protocol port number
- process_open_sockets.remote_port - Socket remote port
- socket_events.remote_port - Remote network protocol port number
remote_ports - keyword, text.text
- windows_firewall_rules.remote_ports - Remote ports for the rule
removable - keyword, number.long
- usb_devices.removable - 1 If USB device is removable else 0
repository - keyword, text.text
- portage_packages.repository - From which repository the ebuild was used
request_id - keyword, text.text
- carves.request_id - Identifying value of the carve request (e.g., scheduled query name, distributed request, etc)
requested_mask - keyword, text.text
- apparmor_events.requested_mask - Requested access mask
requirement - keyword, text.text
- gatekeeper_approved_apps.requirement - Code signing requirement language
reservation_id - keyword, text.text
- ec2_instance_metadata.reservation_id - ID of the reservation
reshape_finish - keyword, text.text
- md_devices.reshape_finish - Estimated duration of reshape activity
reshape_progress - keyword, text.text
- md_devices.reshape_progress - Progress of the reshape activity
reshape_speed - keyword, text.text
- md_devices.reshape_speed - Speed of reshape activity
resident_size - keyword, number.long
- docker_container_processes.resident_size - Bytes of private memory used by process
- processes.resident_size - Bytes of private memory used by process
resolution - keyword, text.text
- connected_displays.resolution - The resolution of the display.
resource_group_name - keyword, text.text
- azure_instance_metadata.resource_group_name - Resource group for the VM
response_code - keyword, number.long
- curl.response_code - The HTTP status code for the response
responsible - keyword, text.text
- crashes.responsible - Process responsible for the crashed process
result - keyword, text.text
- authenticode.result - The signature check result
- curl.result - The HTTP response body
result_code - keyword, text.text
- windows_update_history.result_code - Result of an operation on an update
resync_finish - keyword, text.text
- md_devices.resync_finish - Estimated duration of resync activity
resync_progress - keyword, text.text
- md_devices.resync_progress - Progress of the resync activity
resync_speed - keyword, text.text
- md_devices.resync_speed - Speed of resync activity
retain_count - keyword, number.long
- iokit_devicetree.retain_count - The device reference count
- iokit_registry.retain_count - The node reference count
revision - keyword, text.text
- deb_packages.revision - Package revision
- hardware_events.revision - Device revision (optional)
- platform_info.revision - BIOS major and minor revision
roaming - keyword, number.long
- wifi_networks.roaming - 1 if roaming is supported, 0 otherwise
roaming_profile - keyword, text.text
- wifi_networks.roaming_profile - Describe the roaming profile, usually one of Single, Dual or Multi
root - keyword, text.text
- processes.root - Process virtual root directory
root_dir - keyword, text.text
- docker_info.root_dir - Docker root directory
root_directory - keyword, text.text
- launchd.root_directory - Key used to specify a directory to chroot to before launch
root_volume_uuid - keyword, text.text
- time_machine_destinations.root_volume_uuid - Root UUID of backup volume
rotation - keyword, text.text
- connected_displays.rotation - The orientation of the display.
round_trip_time - keyword, number.long
- curl.round_trip_time - Time taken to complete the request
rowid - keyword, number.long
- quicklook_cache.rowid - Quicklook file rowid key
rssi - keyword, number.long
- wifi_status.rssi - The current received signal strength indication (dbm)
- wifi_survey.rssi - The current received signal strength indication (dbm)
rtadv_accept - keyword, number.long
- interface_ipv6.rtadv_accept - Accept ICMP Router Advertisement
rule_details - keyword, text.text
- sudoers.rule_details - Rule definition
run_at_load - keyword, text.text
- launchd.run_at_load - Should the program run on launch load
run_count - keyword, number.long
- prefetch.run_count - Number of times the application has been run.
rw - keyword, number.long
- docker_container_mounts.rw - 1 if read/write. 0 otherwise
scheme - keyword, text.text
- app_schemes.scheme - Name of the scheme/protocol
scope - keyword, text.text
- selinux_settings.scope - Where the key is located inside the SELinuxFS mount point.
screen_sharing - keyword, number.long
- sharing_preferences.screen_sharing - 1 If screen sharing is enabled else 0
script - keyword, text.text
- chrome_extension_content_scripts.script - The content script used by the extension
script_block_count - keyword, number.long
- powershell_events.script_block_count - The total number of script blocks for this script
script_block_id - keyword, text.text
- powershell_events.script_block_id - The unique GUID of the powershell script to which this block belongs
script_file_name - keyword, text.text
- wmi_script_event_consumers.script_file_name - Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.
script_name - keyword, text.text
- powershell_events.script_name - The name of the Powershell script
script_path - keyword, text.text
- powershell_events.script_path - The path for the Powershell script
script_text - keyword, text.text
- powershell_events.script_text - The text content of the Powershell script
- wmi_script_event_consumers.script_text - Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.
scripting_engine - keyword, text.text
- wmi_script_event_consumers.scripting_engine - Name of the scripting engine to use, for example, VBScript. This property cannot be NULL.
sdb_id - keyword, text.text
- appcompat_shims.sdb_id - Unique GUID of the SDB.
sdk - keyword, text.text
- browser_plugins.sdk - Build SDK used to compile plugin
- safari_extensions.sdk - Bundle SDK used to compile extension
sdk_version - keyword, text.text
- osquery_extensions.sdk_version - osquery SDK version used to build the extension
seconds - keyword, number.long
- time.seconds - Current seconds in UTC
- uptime.seconds - Seconds of uptime
section - keyword, text.text
- deb_packages.section - Package section
secure_boot - keyword, number.long
- secureboot.secure_boot - Whether secure boot is enabled
secure_mode - keyword, number.long
- secureboot.secure_mode - Secure mode for Intel-based macOS: 0 disabled, 1 full security, 2 medium security
secure_process - keyword, number.long
- processes.secure_process - Process is secure (IUM) yes=1, no=0
security_breach - keyword, text.text
- chassis_info.security_breach - The physical status of the chassis such as Breach Successful, Breach Attempted, etc.
security_groups - keyword, text.text
- ec2_instance_metadata.security_groups - Comma separated list of security group names
security_options - keyword, text.text
- docker_containers.security_options - List of container security options
security_type - keyword, text.text
- wifi_networks.security_type - Type of security on this network
- wifi_status.security_type - Type of security on this network
self_signed - keyword, number.long
- certificates.self_signed - 1 if self-signed, else 0
sender - keyword, text.text
- asl.sender - Sender’s identification string. Default is process name.
- unified_log.sender - the name of the binary image that made the entry
sensor_backend_server - keyword, text.text
- carbon_black_info.sensor_backend_server - Carbon Black server
sensor_id - keyword, number.long
- carbon_black_info.sensor_id - Sensor ID of the Carbon Black sensor
sensor_ip_addr - keyword, text.text
- carbon_black_info.sensor_ip_addr - IP address of the sensor
seq_num - keyword, number.long
- es_process_events.seq_num - Per event sequence number
- es_process_file_events.seq_num - Per event sequence number
serial - keyword, text.text
- certificates.serial - Certificate serial number
- chassis_info.serial - The serial number of the chassis.
- disk_info.serial - The serial number of the disk.
- hardware_events.serial - Device serial (optional)
- usb_devices.serial - USB Device serial connection
serial_number - keyword, text.text
- authenticode.serial_number - The certificate serial number
- battery.serial_number - The battery’s unique serial number
- connected_displays.serial_number - The serial number of the display. (may not be unique)
- curl_certificate.serial_number - Certificate serial number
- kernel_keys.serial_number - The serial key of the key.
- memory_devices.serial_number - Serial number of memory device
serial_port_enabled - keyword, text.text
- ycloud_instance_metadata.serial_port_enabled - Indicates if serial port is enabled for the VM
series - keyword, text.text
- video_info.series - The series of the gpu.
server_name - keyword, text.text
- lxd_cluster.server_name - Name of the LXD server node
- lxd_cluster_members.server_name - Name of the LXD server node
server_selection - keyword, text.text
- windows_update_history.server_selection - Value that indicates which server provided an update
server_version - keyword, text.text
- docker_info.server_version - Server version
service - keyword, text.text
- drivers.service - Driver service name, if one exists
- interface_details.service - The name of the service the network adapter uses.
- iokit_devicetree.service - 1 if the device conforms to IOService else 0
service_exit_code - keyword, number.long
- services.service_exit_code - The service-specific error code that the service returns when an error occurs while the service is starting or stopping
service_id - keyword, text.text
- windows_update_history.service_id - Service identifier of an update service that is not a Windows update
service_key - keyword, text.text
- drivers.service_key - Driver service registry key
service_name - keyword, text.text
- windows_firewall_rules.service_name - Service name property of the application
service_type - keyword, text.text
- services.service_type - Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)
ses - keyword, number.long
- seccomp_events.ses - Session ID of the session from which the analyzed process was invoked
session_id - keyword, number.long
- logon_sessions.session_id - The Terminal Services session identifier.
- process_etw_events.session_id - Session ID
- winbaseobj.session_id - Terminal Services Session Id
session_owner - keyword, text.text
- authorizations.session_owner - Label top-level key
set - keyword, number.long
- memory_devices.set - Identifies if memory device is one of a set of devices. A value of 0 indicates no set affiliation.
setup_mode - keyword, number.long
- secureboot.setup_mode - Whether setup mode is enabled
severity - keyword, number.long
- syslog_events.severity - Syslog severity
sgid - keyword
- docker_container_processes.sgid - Saved group ID
- process_events.sgid - Saved group ID at process start
- process_file_events.sgid - Saved group ID of the process using the file
- processes.sgid - Unsigned saved group ID
sha1 - keyword, text.text
- apparmor_profiles.sha1 - A unique hash that identifies this policy.
- certificates.sha1 - SHA1 hash of the raw certificate contents
- device_hash.sha1 - SHA1 hash of provided inode data
- file_events.sha1 - The SHA1 of the file after change
- hash.sha1 - SHA1 hash of provided filesystem data
- rpm_packages.sha1 - SHA1 hash of the package contents
sha1_fingerprint - keyword, text.text
- curl_certificate.sha1_fingerprint - SHA1 fingerprint
sha256 - keyword, text.text
- carves.sha256 - A SHA256 sum of the carved archive
- device_hash.sha256 - SHA256 hash of provided inode data
- file_events.sha256 - The SHA256 of the file after change
- hash.sha256 - SHA256 hash of provided filesystem data
- rpm_package_files.sha256 - SHA256 file digest from RPM info DB
sha256_fingerprint - keyword, text.text
- curl_certificate.sha256_fingerprint - SHA-256 fingerprint
shard - keyword, number.long
- osquery_packs.shard - Shard restriction limit, 1-100, 0 meaning no restriction
share - keyword, text.text
- nfs_shares.share - Filesystem path to the share
shared - keyword, text.text
- authorizations.shared - Label top-level key
shell - keyword, text.text
- users.shell - User’s configured default shell
shell_only - keyword, number.long
- osquery_flags.shell_only - Is the flag shell only?
shmid - keyword, number.long
- shared_memory.shmid - Shared memory segment ID
sid - keyword, text.text
- background_activities_moderator.sid - User SID.
- certificates.sid - SID
- logged_in_users.sid - The user’s unique security identifier
- office_mru.sid - User SID
- shellbags.sid - User SID
- userassist.sid - User SID.
sig - keyword, number.long
- seccomp_events.sig - Signal value sent to process by seccomp
sig_group - keyword, text.text
- yara.sig_group - Signature group used
sigfile - keyword, text.text
- yara.sigfile - Signature file used
signature - keyword, text.text
- curl_certificate.signature - Signature
signature_algorithm - keyword, text.text
- curl_certificate.signature_algorithm - Signature Algorithm
signatures_up_to_date - keyword, number.long
- windows_security_products.signatures_up_to_date - 1 if product signatures are up to date, else 0
signed - keyword, number.long
- drivers.signed - Whether the driver is signed or not
- signature.signed - 1 If the file is signed else 0
signing_algorithm - keyword, text.text
- certificates.signing_algorithm - Signing algorithm used
signing_id - keyword, text.text
- es_process_events.signing_id - Signature identifier of the process
sigrule - keyword, text.text
- yara.sigrule - Signature strings used
sigurl - keyword, text.text
- yara.sigurl - Signature url
size - keyword
- acpi_tables.size - Size of compiled table data
- block_devices.size - Block device size in blocks
- carves.size - Size of the carved archive
- cups_jobs.size - The size of the print job
- deb_packages.size - Package size in bytes
- device_file.size - Size of file in bytes
- disk_events.size - Size of partition in bytes
- docker_image_history.size - Size of instruction in bytes
- file.size - Size of file in bytes
- file_events.size - Size of file in bytes
- kernel_extensions.size - Bytes of wired memory used by extension
- kernel_modules.size - Size of module content
- logical_drives.size - The total amount of space, in bytes, of the drive (-1 on failure).
- lxd_images.size - Size of image in bytes
- lxd_storage_pools.size - Size of the storage pool
- md_devices.size - size of the array in blocks
- memory_devices.size - Size of memory device in Megabyte
- package_bom.size - Expected file size
- platform_info.size - Size in bytes of firmware
- portage_packages.size - The size of the package
- prefetch.size - Application file size.
- quicklook_cache.size - Parsed version size field
- rpm_package_files.size - Expected file size in bytes from RPM info DB
- rpm_packages.size - Package size in bytes
- shared_memory.size - Size in bytes
- smbios_tables.size - Table entry size in bytes
- smc_keys.size - Reported size of data in bytes
- windows_search.size - The item size in bytes.
size_bytes - keyword, number.long
- docker_images.size_bytes - Size of image in bytes
sku - keyword, text.text
- azure_instance_metadata.sku - SKU for the VM image
- chassis_info.sku - The Stock Keeping Unit number if available.
slot - keyword
- md_drives.slot - Slot position of disk
- portage_packages.slot - The slot used by package
smbios_tag - keyword, text.text
- chassis_info.smbios_tag - The assigned asset tag number of the chassis.
socket - keyword
- listening_ports.socket - Socket handle or inode number
- process_open_sockets.socket - Socket handle or inode number
- socket_events.socket - The local path (UNIX domain socket only)
socket_designation - keyword, text.text
- cpu_info.socket_designation - The assigned socket on the board for the given CPU.
soft_limit - keyword, text.text
- ulimit_info.soft_limit - Current limit value
softirq - keyword, number.long
- cpu_time.softirq - Time spent servicing softirqs
sort - keyword, text.text
- windows_search.sort - Sort for windows api
source - keyword, text.text
- apt_sources.source - Source file
- autoexec.source - Source table of the autoexec item
- deb_packages.source - Package source
- docker_container_mounts.source - Source path on host
- lxd_storage_pools.source - Storage pool source
- package_install_history.source - Install source: usually the installer process name
- routes.source - Route source
- rpm_packages.source - Source RPM package name (optional)
- shellbags.source - Shellbags source Registry file
- startup_items.source - Directory or plist containing startup item
- sudoers.source - Source file containing the given rule
- windows_events.source - Source or channel of the event
source_path - keyword, text.text
- systemd_units.source_path - Path to the (possibly generated) unit configuration file
source_url - keyword, text.text
- firefox_addons.source_url - URL that installed the addon
space_total - keyword, number.long
- lxd_storage_pools.space_total - Total available storage space in bytes for this storage pool
space_used - keyword, number.long
- lxd_storage_pools.space_used - Storage space used in bytes
spare_disks - keyword, number.long
- md_devices.spare_disks - Number of idle disks in array
spec_version - keyword, text.text
- tpm_info.spec_version - Trusted Computing Group specification that the TPM supports
speculative - keyword, number.long
- virtual_memory_info.speculative - Total number of speculative pages.
speed - keyword, number.long
- interface_details.speed - Estimate of the current bandwidth in bits per second.
src_ip - keyword, text.text
- iptables.src_ip - Source IP address.
src_mask - keyword, text.text
- iptables.src_mask - Source IP address mask.
src_port - keyword, text.text
- iptables.src_port - Protocol source port(s).
ssh_config_file - keyword, text.text
- ssh_configs.ssh_config_file - Path to the ssh_config file
ssh_public_key - keyword, text.text
- ec2_instance_metadata.ssh_public_key - SSH public key. Only available if supplied at instance launch time
- ycloud_instance_metadata.ssh_public_key - SSH public key. Only available if supplied at instance launch time
ssid - keyword, text.text
- wifi_networks.ssid - SSID octets of the network
- wifi_status.ssid - SSID octets of the network
- wifi_survey.ssid - SSID octets of the network
stack_trace - keyword, text.text
- crashes.stack_trace - Most recent frame from the stack trace
- windows_crashes.stack_trace - Multiple stack frames from the stack trace
start - keyword, text.text
- memory_map.start - Start address of memory region
- process_memory_map.start - Virtual start address (hex)
start_interval - keyword, text.text
- launchd.start_interval - Frequency to run in seconds
start_on_mount - keyword, text.text
- launchd.start_on_mount - Run daemon or agent every time a filesystem is mounted
start_time - keyword, number.long
- docker_container_processes.start_time - Process start in seconds since boot (non-sleeping)
- osquery_info.start_time - UNIX time in seconds when the process started
- processes.start_time - Process start time in seconds since Epoch, in case of error -1
start_type - keyword, text.text
- services.start_type - Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED
started_at - keyword, text.text
- docker_containers.started_at - Container start time as string
starting_address - keyword, text.text
- memory_array_mapped_addresses.starting_address - Physical stating address, in kilobytes, of a range of memory mapped to physical memory array
- memory_device_mapped_addresses.starting_address - Physical stating address, in kilobytes, of a range of memory mapped to physical memory array
state - keyword
- alf_exceptions.state - Firewall exception state
- battery.state - One of the following: "AC Power" indicates the battery is connected to an external power source, "Battery Power" indicates that the battery is drawing internal power, "Off Line" indicates the battery is off-line or no longer connected
- chrome_extensions.state - 1 if this extension is enabled
- docker_container_processes.state - Process state
- docker_containers.state - Container state (created, restarting, running, removing, paused, exited, dead)
- lxd_networks.state - Network status
- md_drives.state - State of the drive
- process_open_sockets.state - TCP socket state
- processes.state - Process state
- scheduled_tasks.state - State of the scheduled task
- system_extensions.state - System extension state
- windows_optional_features.state - Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent
- windows_security_products.state - State of protection
state_timestamp - keyword, text.text
- windows_security_products.state_timestamp - Timestamp for the product state
stateful - keyword, number.long
- lxd_instances.stateful - Whether the instance is stateful(1) or not(0)
statename - keyword, text.text
- windows_optional_features.statename - Installation state name. Enabled,Disabled,Absent
status - keyword, text.text
- carves.status - Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED
- chassis_info.status - If available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail.
- deb_packages.status - Package status
- docker_containers.status - Container status information
- kernel_modules.status - Kernel module status
- lxd_cluster_members.status - Status of the node (Online/Offline)
- lxd_instances.status - Instance state (running, stopped, etc.)
- md_devices.status - Current state of the array
- ntdomains.status - The current status of the domain object.
- process_events.status - OpenBSM Attribute: Status of the process
- services.status - Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED
- shared_memory.status - Destination/attach status
- shared_resources.status - String that indicates the current status of the object.
- socket_events.status - Either succeeded, failed, in_progress (connect() on non-blocking socket) or no_client (null accept() on non-blocking socket)
- startup_items.status - Startup status; either enabled or disabled
stderr_path - keyword, text.text
- launchd.stderr_path - Pipe stderr to a target path
stdout_path - keyword, text.text
- launchd.stdout_path - Pipe stdout to a target path
steal - keyword, number.long
- cpu_time.steal - Time spent in other operating systems when running in a virtualized environment
stealth_enabled - keyword, number.long
- alf.stealth_enabled - 1 If stealth mode is enabled else 0
stibp_support_enabled - keyword, number.long
- kva_speculative_info.stibp_support_enabled - Windows uses STIBP.
storage - keyword, number.long
- unified_log.storage - the storage category for the entry
storage_driver - keyword, text.text
- docker_info.storage_driver - Storage driver
store - keyword, text.text
- certificates.store - Certificate system store
store_id - keyword, text.text
- certificates.store_id - Exists for service/user stores. Contains raw store id provided by WinAPI.
store_location - keyword, text.text
- certificates.store_location - Certificate system store location
strings - keyword, text.text
- yara.strings - Matching strings
- yara_events.strings - Matching strings
sub_state - keyword, text.text
- systemd_units.sub_state - The low-level unit activation state, values depend on unit type
subclass - keyword, text.text
- usb_devices.subclass - USB Device subclass
subject - keyword, text.text
- certificates.subject - Certificate distinguished name (deprecated, use subject2)
subject2 - keyword, text.text
- certificates.subject2 - Certificate distinguished name
subject_alternative_names - keyword, text.text
- curl_certificate.subject_alternative_names - Subject Alternative Name
subject_info_access - keyword, text.text
- curl_certificate.subject_info_access - Subject Information Access
subject_key_id - keyword, text.text
- certificates.subject_key_id - SKID an optionally included SHA1
subject_key_identifier - keyword, text.text
- curl_certificate.subject_key_identifier - Subject Key Identifier
subject_name - keyword, text.text
- authenticode.subject_name - The certificate subject name
subkey - keyword, text.text
- plist.subkey - Intermediate key path, includes lists/dicts
- preferences.subkey - Intemediate key path, includes lists/dicts
subnet - keyword, text.text
- docker_networks.subnet - Network subnet
subscription_id - keyword, text.text
- azure_instance_metadata.subscription_id - Azure subscription for the VM
subscriptions - keyword, number.long
- osquery_events.subscriptions - Number of subscriptions the publisher received or subscriber used
subsystem - keyword, text.text
- system_controls.subsystem - Subsystem ID, control type
- unified_log.subsystem - the subsystem of the os_log_t used
subsystem_model - keyword, text.text
- pci_devices.subsystem_model - Device description of PCI device subsystem
subsystem_model_id - keyword, text.text
- pci_devices.subsystem_model_id - Model ID of PCI device subsystem
subsystem_vendor - keyword, text.text
- pci_devices.subsystem_vendor - Vendor of PCI device subsystem
subsystem_vendor_id - keyword, text.text
- pci_devices.subsystem_vendor_id - Vendor ID of PCI device subsystem
success - keyword, number.long
- socket_events.success - Deprecated. Use the status column instead
suid - keyword
- docker_container_processes.suid - Saved user ID
- process_events.suid - Saved user ID at process start
- process_file_events.suid - Saved user ID of the process using the file
- processes.suid - Unsigned saved user ID
summary - keyword, text.text
- chocolatey_packages.summary - Package-supplied summary
- python_packages.summary - Package-supplied summary
superblock_state - keyword, text.text
- md_devices.superblock_state - State of the superblock
superblock_update_time - keyword, number.long
- md_devices.superblock_update_time - Unix timestamp of last update
superblock_version - keyword, text.text
- md_devices.superblock_version - Version of the superblock
support_url - keyword, text.text
- windows_update_history.support_url - Hyperlink to the language-specific support information for an update
swap_cached - keyword, number.long
- memory_info.swap_cached - The amount of swap, in bytes, used as cache memory
swap_free - keyword, number.long
- memory_info.swap_free - The total amount of swap free, in bytes
swap_ins - keyword, number.long
- virtual_memory_info.swap_ins - The total number of compressed pages that have been swapped out to disk.
swap_limit - keyword, number.long
- docker_info.swap_limit - 1 if swap limit support is enabled. 0 otherwise
swap_outs - keyword, number.long
- virtual_memory_info.swap_outs - The total number of compressed pages that have been swapped back in from disk.
swap_total - keyword, number.long
- memory_info.swap_total - The total amount of swap available, in bytes
symlink - keyword, number.long
- file.symlink - 1 if the path is a symlink, otherwise 0
syscall - keyword, text.text
- bpf_process_events.syscall - System call name
- bpf_socket_events.syscall - System call name
- process_events.syscall - Syscall name: fork, vfork, clone, execve, execveat
- seccomp_events.syscall - Type of the system call
system - keyword, number.long
- cpu_time.system - Time spent in system mode
system_cpu_usage - keyword, number.long
- docker_container_stats.system_cpu_usage - CPU system usage
system_model - keyword, text.text
- kernel_panics.system_model - Physical system model, for example MacBookPro12,1 (Mac-E43C1C25D4880AD6)
system_time - keyword, number.long
- osquery_schedule.system_time - Total system time in milliseconds spent executing
- processes.system_time - CPU time in milliseconds spent in kernel space
tag - keyword, text.text
- syslog_events.tag - The syslog tag
tags - keyword, text.text
- docker_image_history.tags - Comma-separated list of tags
- docker_images.tags - Comma-separated list of repository tags
- yara.tags - Matching tags
- yara_events.tags - Matching tags
tapping_process - keyword, number.long
- event_taps.tapping_process - The process ID of the application that created the event tap.
target - keyword
- fan_speed_sensors.target - Target speed
- iptables.target - Target that applies for this rule.
target_name - keyword, text.text
- prometheus_metrics.target_name - Address of prometheus target
target_path - keyword, text.text
- file_events.target_path - The path associated with the event
- yara_events.target_path - The path scanned
task - keyword, number.long
- windows_eventlog.task - Task value associated with the event
- windows_events.task - Task value associated with the event
team - keyword, text.text
- system_extensions.team - Signing team ID
team_id - keyword, text.text
- es_process_events.team_id - Team identifier of thd process
team_identifier - keyword, text.text
- signature.team_identifier - The team signing identifier sealed into the signature
temporarily_disabled - keyword, number.long
- wifi_networks.temporarily_disabled - 1 if this network is temporarily disabled, 0 otherwise
terminal - keyword, text.text
- user_events.terminal - The network protocol ID
threads - keyword, number.long
- docker_container_processes.threads - Number of threads used by process
- processes.threads - Number of threads used by process
throttled - keyword, number.long
- virtual_memory_info.throttled - Total number of throttled pages.
tid - keyword, number.long
- bpf_process_events.tid - Thread ID
- bpf_socket_events.tid - Thread ID
- unified_log.tid - the tid of the thread that made the entry
- windows_crashes.tid - Thread ID of the crashed thread
- windows_eventlog.tid - Thread ID which emitted the event record
time - keyword
- apparmor_events.time - Time of execution in UNIX time
- asl.time - Unix timestamp. Set automatically
- bpf_process_events.time - Time of execution in UNIX time
- bpf_socket_events.time - Time of execution in UNIX time
- carves.time - Time at which the carve was kicked off
- disk_events.time - Time of appearance/disappearance in UNIX time
- docker_container_processes.time - Cumulative CPU time. [DD-]HH:MM:SS format
- es_process_events.time - Time of execution in UNIX time
- es_process_file_events.time - Time of execution in UNIX time
- file_events.time - Time of file event
- hardware_events.time - Time of hardware event
- kernel_panics.time - Formatted time of the event
- last.time - Entry timestamp
- logged_in_users.time - Time entry was made
- ntfs_journal_events.time - Time of file event
- package_install_history.time - Label date as UNIX timestamp
- powershell_events.time - Timestamp the event was received by the osquery event publisher
- process_etw_events.time - Event timestamp in Unix format
- process_events.time - Time of execution in UNIX time
- process_file_events.time - Time of execution in UNIX time
- seccomp_events.time - Time of execution in UNIX time
- selinux_events.time - Time of execution in UNIX time
- shell_history.time - Entry timestamp. It could be absent, default value is 0.
- socket_events.time - Time of execution in UNIX time
- syslog_events.time - Current unix epoch time
- user_events.time - Time of execution in UNIX time
- user_interaction_events.time - Time
- windows_events.time - Timestamp the event was received
- xprotect_reports.time - Quarantine alert time
- yara_events.time - Time of the scan
time_nano_sec - keyword, number.long
- asl.time_nano_sec - Nanosecond time.
time_range - keyword, text.text
- windows_eventlog.time_range - System time to selectively filter the events
time_windows - keyword, number.long
- process_etw_events.time_windows - Event timestamp in Windows format
timeout - keyword, text.text
- authorizations.timeout - Label top-level key
- curl_certificate.timeout - Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)
- kernel_keys.timeout - The amount of time until the key will expire,expressed in human-readable form. The string perm heremeans that the key is permanent (no timeout). Thestring expd means that the key has already expired.
timestamp - keyword, text.text
- time.timestamp - Current timestamp (log format) in UTC
- unified_log.timestamp - unix timestamp associated with the entry
- windows_eventlog.timestamp - Timestamp to selectively filter the events
timestamp_ms - keyword, number.long
- prometheus_metrics.timestamp_ms - Unix timestamp of collected data in MS
timezone - keyword, text.text
- time.timezone - Timezone for reported time (hardcoded to UTC)
title - keyword, text.text
- cups_jobs.title - Title of the printed job
- windows_update_history.title - Title of an update
token_elevation_status - keyword, number.long
- process_etw_events.token_elevation_status - Primary token elevation status - Present only on ProcessStart events
token_elevation_type - keyword, text.text
- process_etw_events.token_elevation_type - Primary token elevation type - Present only on ProcessStart events
total_seconds - keyword, number.long
- uptime.total_seconds - Total uptime seconds
total_size - keyword, number.long
- docker_container_processes.total_size - Total virtual memory size
- processes.total_size - Total virtual memory size
total_width - keyword, number.long
- memory_devices.total_width - Total width, in bits, of this memory device, including any check or error-correction bits
transaction_id - keyword, number.long
- file_events.transaction_id - ID used during bulk update
- yara_events.transaction_id - ID used during bulk update
translated - keyword, number.long
- processes.translated - Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.
transmit_rate - keyword, text.text
- wifi_status.transmit_rate - The current transmit rate
tries - keyword, text.text
- authorizations.tries - Label top-level key
tty - keyword, text.text
- last.tty - Entry terminal
- logged_in_users.tty - Device name
turbo_disabled - keyword, number.long
- msr.turbo_disabled - Whether the turbo feature is disabled.
turbo_ratio_limit - keyword, number.long
- msr.turbo_ratio_limit - The turbo feature ratio limit.
type - keyword, text.text
- apparmor_events.type - Event type
- appcompat_shims.type - Type of the SDB database.
- block_devices.type - Block device type string
- bpf_socket_events.type - The socket type
- crashes.type - Type of crash log
- device_file.type - File status
- device_firmware.type - Type of device
- device_partitions.type -
- disk_encryption.type - Description of cipher type and mode if available
- disk_info.type - The interface type of the disk.
- dns_cache.type - DNS record type
- dns_resolvers.type - Address type: sortlist, nameserver, search
- docker_container_mounts.type - Type of mount (bind, volume)
- docker_container_ports.type - Protocol (tcp, udp)
- docker_volumes.type - Volume type
- file.type - File status
- firefox_addons.type - Extension, addon, webapp
- hardware_events.type - Type of hardware and hardware event
- interface_addresses.type - Type of address. One of dhcp, manual, auto, other, unknown
- interface_details.type - Interface type (includes virtual)
- kernel_keys.type - The key type.
- keychain_items.type - Keychain item type (class)
- last.type - Entry type, according to ut_type types (utmp.h)
- logged_in_users.type - Login type
- logical_drives.type - Deprecated (always Unknown).
- lxd_certificates.type - Type of the certificate
- lxd_networks.type - Type of network
- mounts.type - Mounted device type
- ntfs_acl_permissions.type - Type of access mode for the access control entry.
- nvram.type - Data type (CFData, CFString, etc)
- osquery_events.type - Either publisher or subscriber
- osquery_extensions.type - SDK extension type: core, extension, or module
- osquery_flags.type - Flag type
- process_etw_events.type - Event Type (ProcessStart, ProcessStop)
- process_open_pipes.type - Pipe Type: named vs unnamed/anonymous
- registry.type - Type of the registry value, or subkey if item is a subkey
- routes.type - Type of route
- selinux_events.type - Event type
- shared_resources.type - Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.
- smbios_tables.type - Table entry type
- smc_keys.type - SMC-reported type literal type
- startup_items.type - Startup Item or Login Item
- system_controls.type - Data type
- ulimit_info.type - System resource to be limited
- user_events.type - The file description for the process socket
- users.type - Whether the account is roaming (domain), local, or a system profile
- windows_crashes.type - Type of crash log
- windows_search.type - The item type
- windows_security_products.type - Type of security product
- xprotect_meta.type - Either plugin or extension
type_name - keyword, text.text
- last.type_name - Entry type name, according to ut_type types (utmp.h)
- shared_resources.type_name - Human readable value for the type column
uid - keyword
- account_policy_data.uid - User ID
- asl.uid - UID that sent the log message (set by the server).
- atom_packages.uid - The local user that owns the plugin
- authorized_keys.uid - The local owner of authorized_keys file
- bpf_process_events.uid - User ID
- bpf_socket_events.uid - User ID
- browser_plugins.uid - The local user that owns the plugin
- chrome_extension_content_scripts.uid - The local user that owns the extension
- chrome_extensions.uid - The local user that owns the extension
- crashes.uid - User ID of the crashed process
- device_file.uid - Owning user ID
- disk_encryption.uid - Currently authenticated user if available
- docker_container_processes.uid - User ID
- es_process_events.uid - User ID of the process
- file.uid - Owning user ID
- file_events.uid - Owning user ID
- firefox_addons.uid - The local user that owns the addon
- kernel_keys.uid - The user ID of the key owner.
- known_hosts.uid - The local user that owns the known_hosts file
- launchd_overrides.uid - User ID applied to the override, 0 applies to all
- package_bom.uid - Expected user of file or directory
- password_policy.uid - User ID for the policy, -1 for policies that are global
- process_events.uid - User ID at process start
- process_file_events.uid - The uid of the process performing the action
- processes.uid - Unsigned user ID
- safari_extensions.uid - The local user that owns the extension
- seccomp_events.uid - User ID of the user who started the analyzed process
- shell_history.uid - Shell history owner
- ssh_configs.uid - The local owner of the ssh_config file
- user_events.uid - User ID
- user_groups.uid - User ID
- user_ssh_keys.uid - The local user that owns the key file
- users.uid - User ID
uid_signed - keyword, number.long
- users.uid_signed - User ID as int64 signed (Apple)
umci_policy_status - keyword, text.text
- hvci_status.umci_policy_status - The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.
uncompressed - keyword, number.long
- virtual_memory_info.uncompressed - Total number of uncompressed pages.
uninstall_string - keyword, text.text
- programs.uninstall_string - Path and filename of the uninstaller.
unique_chip_id - keyword, text.text
- ibridge_info.unique_chip_id - Unique id of the iBridge controller
unit_file_state - keyword, text.text
-
systemd_units.unit_file_state - Whether the unit file is enabled, e.g.
enabled,masked,disabled, etc
unix_time - keyword, number.long
- time.unix_time - Current UNIX time in UTC
unmask - keyword, number.long
- portage_keywords.unmask - If the package is unmasked
unused_devices - keyword, text.text
- md_devices.unused_devices - Unused devices
update_id - keyword, text.text
- windows_update_history.update_id - Revision-independent identifier of an update
update_revision - keyword, number.long
- windows_update_history.update_revision - Revision number of an update
update_source_alias - keyword, text.text
- lxd_images.update_source_alias - Alias of image at update source server
update_source_certificate - keyword, text.text
- lxd_images.update_source_certificate - Certificate for update source server
update_source_protocol - keyword, text.text
- lxd_images.update_source_protocol - Protocol used for image information update and image import from source server
update_source_server - keyword, text.text
- lxd_images.update_source_server - Server for image update
update_url - keyword, text.text
- chrome_extensions.update_url - Extension-supplied update URI
- safari_extensions.update_url - Extension-supplied update URI
upid - keyword, number.long
- processes.upid - A 64bit pid that is never reused. Returns -1 if we couldn’t gather them from the system.
uploaded_at - keyword, text.text
- lxd_images.uploaded_at - ISO time of image upload
upn - keyword, text.text
- logon_sessions.upn - The user principal name (UPN) for the owner of the logon session.
uppid - keyword, number.long
- processes.uppid - The 64bit parent pid that is never reused. Returns -1 if we couldn’t gather them from the system.
uptime - keyword, number.long
- apparmor_events.uptime - Time of execution in system uptime
- kernel_panics.uptime - System uptime at kernel panic in nanoseconds
- process_events.uptime - Time of execution in system uptime
- process_file_events.uptime - Time of execution in system uptime
- seccomp_events.uptime - Time of execution in system uptime
- selinux_events.uptime - Time of execution in system uptime
- socket_events.uptime - Time of execution in system uptime
- user_events.uptime - Time of execution in system uptime
url - keyword, text.text
- curl.url - The url for the request
- lxd_cluster_members.url - URL of the node
usage - keyword, number.long
- kernel_keys.usage - the number of threads and open file references thatrefer to this key.
usb_address - keyword, number.long
- usb_devices.usb_address - USB Device used address
usb_port - keyword, number.long
- usb_devices.usb_port - USB Device used port
use - keyword, text.text
- memory_arrays.use - Function for which the array is used
- portage_use.use - USE flag which has been enabled for package
used_by - keyword, text.text
- kernel_modules.used_by - Module reverse dependencies
- lxd_networks.used_by - URLs for containers using this network
user - keyword
- cpu_time.user - Time spent in user mode
- cups_jobs.user - The user who printed the job
- docker_container_processes.user - User name
- logged_in_users.user - User login name
- logon_sessions.user - The account name of the security principal that owns the logon session.
- sandboxes.user - Sandbox owner
- systemd_units.user - The configured user, if any
user_account - keyword, text.text
- services.user_account - The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\UserName. If the account belongs to the built-in domain, the name can be of the form .\UserName.
user_account_control - keyword, text.text
- windows_security_center.user_account_control - The health of the User Account Control (UAC) capability in Windows
user_action - keyword, text.text
- xprotect_reports.user_action - Action taken by user after prompted
user_agent - keyword, text.text
- curl.user_agent - The user-agent string to use for the request
user_namespace - keyword, text.text
- docker_containers.user_namespace - User namespace
- process_namespaces.user_namespace - user namespace inode
user_time - keyword, number.long
- osquery_schedule.user_time - Total user time in milliseconds spent executing
- processes.user_time - CPU time in milliseconds spent in user space
user_uuid - keyword, text.text
- disk_encryption.user_uuid - UUID of authenticated user if available
username - keyword, text.text
- certificates.username - Username
- es_process_events.username - Username
- last.username - Entry username
- launchd.username - Run this daemon or agent as this username
- managed_policies.username - Policy applies only this user
- preferences.username - (optional) read preferences for a specific user
- process_etw_events.username - User rights - primary token username
- rpm_package_files.username - File default username from info DB
- shadow.username - Username
- startup_items.username - The user associated with the startup item
- suid_bin.username - Binary owner username
- users.username - Username
- windows_crashes.username - Username of the user who ran the crashed process
uses_pattern - keyword, number.long
- xprotect_entries.uses_pattern - Uses a match pattern instead of identity
uts_namespace - keyword, text.text
- docker_containers.uts_namespace - UTS namespace
- process_namespaces.uts_namespace - uts namespace inode
uuid - keyword, text.text
- block_devices.uuid - Block device Universally Unique Identifier
- disk_encryption.uuid - Disk Universally Unique Identifier
- disk_events.uuid - UUID of the volume inside DMG if available
- managed_policies.uuid - Optional UUID assigned to policy set
- osquery_extensions.uuid - The transient ID assigned for communication
- osquery_info.uuid - Unique ID provided by the system
- system_info.uuid - Unique ID provided by the system
- users.uuid - User’s UUID (Apple) or SID (Windows)
valid_from - keyword, text.text
- curl_certificate.valid_from - Period of validity start date
valid_to - keyword, text.text
- curl_certificate.valid_to - Period of validity end date
value - keyword, text.text
- ad_config.value - Variable typed option value
- augeas.value - The value of the configuration item
- azure_instance_tags.value - The tag value
- cpuid.value - Bit value or string
- default_environment.value - Value of the environment variable
- docker_container_envs.value - Environment variable value
- docker_container_labels.value - Optional label value
- docker_image_labels.value - Optional label value
- docker_network_labels.value - Optional label value
- docker_volume_labels.value - Optional label value
- ec2_instance_tags.value - Tag value
- extended_attributes.value - The parsed information from the attribute
- launchd_overrides.value - Overridden value
- lxd_instance_config.value - Configuration parameter value
- lxd_instance_devices.value - Device info param value
- managed_policies.value - Policy value
- mdls.value - Value stored in the metadata key
- nvram.value - Raw variable data
- oem_strings.value - The value of the OEM string
- osquery_flags.value - Flag value
- plist.value - String value of most CF types
- power_sensors.value - Power in Watts
- preferences.value - String value of most CF types
- process_envs.value - Environment variable value
- selinux_settings.value - Active value.
- smc_keys.value - A type-encoded representation of the key value
- wmi_bios_info.value - Value of the Bios setting
valuetype - keyword, text.text
- mdls.valuetype - CoreFoundation type of data stored in value
variable - keyword, text.text
- default_environment.variable - Name of the environment variable
vbs_status - keyword, text.text
- hvci_status.vbs_status - The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.
vendor - keyword, text.text
- block_devices.vendor - Block device vendor string
- disk_events.vendor - Disk event vendor string
- hardware_events.vendor - Hardware device vendor
- pci_devices.vendor - PCI Device vendor
- platform_info.vendor - Platform code vendor
- rpm_packages.vendor - Package vendor
- usb_devices.vendor - USB Device vendor string
vendor_id - keyword, text.text
- connected_displays.vendor_id - The vendor ID of the display.
- hardware_events.vendor_id - Hex encoded Hardware vendor identifier
- pci_devices.vendor_id - Hex encoded PCI Device vendor identifier
- usb_devices.vendor_id - Hex encoded USB Device vendor identifier
vendor_syndrome - keyword, text.text
- memory_error_info.vendor_syndrome - Vendor specific ECC syndrome or CRC data associated with the erroneous access
version - keyword, text.text
- alf.version - Application Layer Firewall version
- apt_sources.version - Repository source version
- atom_packages.version - Package supplied version
- authorizations.version - Label top-level key
- azure_instance_metadata.version - Version of the VM image
- bitlocker_info.version - The FVE metadata version of the drive.
- browser_plugins.version - Plugin short version
- chocolatey_packages.version - Package-supplied version
- chrome_extension_content_scripts.version - Extension-supplied version
- chrome_extensions.version - Extension-supplied version
- crashes.version - Version info of the crashed process
- curl_certificate.version - Version Number
- deb_packages.version - Package version
- device_firmware.version - Firmware version
- docker_version.version - Docker version
- drivers.version - Driver version
- es_process_events.version - Version of EndpointSecurity event
- es_process_file_events.version - Version of EndpointSecurity event
- firefox_addons.version - Addon-supplied version string
- gatekeeper.version - Version of Gatekeeper’s gke.bundle
- homebrew_packages.version - Current linked version
- hvci_status.version - The version number of the Device Guard build.
- ie_extensions.version - Version of the executable
- intel_me_info.version - Intel ME version
- kernel_extensions.version - Extension version
- kernel_info.version - Kernel version
- npm_packages.version - Package-supplied version
- office_mru.version - Office application version number
- os_version.version - Pretty, suitable for presentation, OS version
- osquery_extensions.version - Extension’s version
- osquery_info.version - osquery toolkit version
- osquery_packs.version - Minimum osquery version that this query will run on
- package_install_history.version - Package display version
- package_receipts.version - Installed package version
- platform_info.version - Platform code version
- portage_keywords.version - The version which are affected by the use flags, empty means all
- portage_packages.version - The version which are affected by the use flags, empty means all
- portage_use.version - The version of the installed package
- programs.version - Product version information.
- python_packages.version - Package-supplied version
- rpm_packages.version - Package version
- safari_extensions.version - Extension long version
- system_extensions.version - System extension version
- usb_devices.version - USB Device version number
- windows_crashes.version - File version info of the crashed process
video_mode - keyword, text.text
- video_info.video_mode - The current resolution of the display.
virtual_process - keyword, number.long
- processes.virtual_process - Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0
visible - keyword, number.long
- firefox_addons.visible - 1 If the addon is shown in browser else 0
visible_alarm - keyword, text.text
- chassis_info.visible_alarm - If TRUE, the frame is equipped with a visual alarm.
vm_id - keyword, text.text
- azure_instance_metadata.vm_id - Unique identifier for the VM
- azure_instance_tags.vm_id - Unique identifier for the VM
vm_scale_set_name - keyword, text.text
- azure_instance_metadata.vm_scale_set_name - VM scale set name
vm_size - keyword, text.text
- azure_instance_metadata.vm_size - VM size
voltage - keyword, number.long
- battery.voltage - The battery’s current voltage in mV
volume_creation - keyword, text.text
- prefetch.volume_creation - Volume creation time.
volume_id - keyword, number.long
- quicklook_cache.volume_id - Parsed volume ID from fs_id
volume_serial - keyword, text.text
- file.volume_serial - Volume serial number
- prefetch.volume_serial - Volume serial number.
volume_size - keyword, number.long
- platform_info.volume_size - (Optional) size of firmware volume
wall_time - keyword, number.long
- osquery_schedule.wall_time - Total wall time in seconds spent executing (deprecated), hidden=True
wall_time_ms - keyword, number.long
- osquery_schedule.wall_time_ms - Total wall time in milliseconds spent executing
warning - keyword, number.long
- shadow.warning - Number of days before password expires to warn user about it
was_captive_network - keyword, number.long
- wifi_networks.was_captive_network - 1 if this network was previously a captive network, 0 otherwise
watch_paths - keyword, text.text
- launchd.watch_paths - Key that launches daemon or agent if path is modified
watcher - keyword, number.long
- osquery_info.watcher - Process (or thread/handle) ID of optional watcher process
weekday - keyword, text.text
- time.weekday - Current weekday in UTC
win32_exit_code - keyword, number.long
- services.win32_exit_code - The error code that the service uses to report an error that occurs when it is starting or stopping
win_timestamp - keyword, number.long
- time.win_timestamp - Timestamp value in 100 nanosecond units
windows_security_center_service - keyword, text.text
- windows_security_center.windows_security_center_service - The health of the Windows Security Center Service
wired - keyword, number.long
- virtual_memory_info.wired - Total number of wired down pages.
wired_size - keyword, number.long
- docker_container_processes.wired_size - Bytes of unpageable memory used by process
- processes.wired_size - Bytes of unpageable memory used by process
working_directory - keyword, text.text
- launchd.working_directory - Key used to specify a directory to chdir to before launch
working_disks - keyword, number.long
- md_devices.working_disks - Number of working disks in array
world - keyword, number.long
- portage_packages.world - If package is in the world file
writable - keyword, number.long
- disk_events.writable - 1 if writable, 0 if not
xpath - keyword, text.text
- windows_eventlog.xpath - The custom query to filter events
year - keyword, number.long
- time.year - Current year in UTC
zero_fill - keyword, number.long
- virtual_memory_info.zero_fill - Total number of zero filled pages.
zone - keyword, text.text
- azure_instance_metadata.zone - Availability zone of the VM
- ycloud_instance_metadata.zone - Availability zone of the VM