Attention
Zercurity has been acquired by JumpCloud.
This documentation will no longer be maintained or updated. You can read more about the acquisition, or signup to JumpCloud today.
Asset Query Schema 2.11.2ΒΆ
Warning
Zercurity will be removing support for Osquery 2.11.2 in a future release. Please update your to Zercurity 2.2 or higher.
Schema
- acpi_tables
- ad_config
- alf
- alf_exceptions
- alf_explicit_auths
- alf_services
- app_schemes
- appcompat_shims
- apps
- apt_sources
- arp_cache
- asl
- augeas
- authenticode
- authorization_mechanisms
- authorizations
- authorized_keys
- autoexec
- block_devices
- browser_plugins
- carbon_black_info
- carves
- certificates
- chocolatey_packages
- chrome_extensions
- cpu_time
- cpuid
- crashes
- crontab
- curl
- curl_certificate
- deb_packages
- device_file
- device_firmware
- device_hash
- device_partitions
- disk_encryption
- disk_events
- dns_resolvers
- docker_container_labels
- docker_container_mounts
- docker_container_networks
- docker_container_ports
- docker_container_processes
- docker_container_stats
- docker_containers
- docker_image_labels
- docker_images
- docker_info
- docker_network_labels
- docker_networks
- docker_version
- docker_volume_labels
- docker_volumes
- drivers
- ec2_instance_metadata
- ec2_instance_tags
- etc_hosts
- etc_protocols
- etc_services
- event_taps
- example
- extended_attributes
- fan_speed_sensors
- fbsd_kmods
- file
- file_events
- firefox_addons
- gatekeeper
- gatekeeper_approved_apps
- groups
- hardware_events
- hash
- homebrew_packages
- ie_extensions
- intel_me_info
- interface_addresses
- interface_details
- iokit_devicetree
- iokit_registry
- iptables
- kernel_extensions
- kernel_info
- kernel_integrity
- kernel_modules
- kernel_panics
- keychain_acls
- keychain_items
- known_hosts
- last
- launchd
- launchd_overrides
- listening_ports
- lldp_neighbors
- load_average
- logged_in_users
- logical_drives
- magic
- managed_policies
- md_devices
- md_drives
- md_personalities
- memory_info
- memory_map
- mounts
- msr
- nfs_shares
- nvram
- opera_extensions
- os_version
- osquery_events
- osquery_extensions
- osquery_flags
- osquery_info
- osquery_packs
- osquery_registry
- osquery_schedule
- package_bom
- package_install_history
- package_receipts
- patches
- pci_devices
- physical_disk_performance
- pipes
- pkg_packages
- platform_info
- plist
- portage_keywords
- portage_packages
- portage_use
- power_sensors
- preferences
- process_envs
- process_events
- process_file_events
- process_memory_map
- process_open_files
- process_open_sockets
- processes
- programs
- prometheus_metrics
- python_packages
- quicklook_cache
- registry
- routes
- rpm_package_files
- rpm_packages
- safari_extensions
- sandboxes
- scheduled_tasks
- services
- shadow
- shared_folders
- shared_memory
- shared_resources
- sharing_preferences
- shell_history
- signature
- sip_config
- smbios_tables
- smc_keys
- socket_events
- startup_items
- sudoers
- suid_bin
- syslog_events
- system_controls
- system_info
- temperature_sensors
- time
- time_machine_backups
- time_machine_destinations
- uptime
- usb_devices
- user_events
- user_groups
- user_interaction_events
- user_ssh_keys
- users
- virtual_memory_info
- wifi_networks
- wifi_status
- wifi_survey
- windows_crashes
- windows_events
- wmi_cli_event_consumers
- wmi_event_filters
- wmi_filter_consumer_binding
- wmi_script_event_consumers
- xprotect_entries
- xprotect_meta
- xprotect_reports
- yara
- yara_events