Hardware (PCI/USB/HID) events from UDEV or IOKit.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: hardware_events

  • Linux
  • Mac OSX

Table schema

Name Type Description
action TEXT Remove, insert, change properties, etc
path TEXT Local device path assigned (optional)
type TEXT Type of hardware and hardware event
driver TEXT Driver claiming the device
vendor TEXT Hardware device vendor
vendor_id TEXT Hex encoded Hardware vendor identifier
model TEXT Hardware device model
model_id TEXT Hex encoded Hardware model identifier
serial TEXT Device serial (optional)
revision TEXT Device revision (optional)
time BIGINT Time of hardware event
eid TEXT Event ID

Query examples

Select all the results for the given table.

SELECT * FROM hardware_events;