Asset Query Schema 3.3.2ΒΆ
- account_policy_data
- acpi_tables
- ad_config
- alf
- alf_exceptions
- alf_explicit_auths
- alf_services
- app_schemes
- appcompat_shims
- apps
- apt_sources
- arp_cache
- asl
- augeas
- authenticode
- authorization_mechanisms
- authorizations
- authorized_keys
- autoexec
- battery
- bitlocker_info
- block_devices
- browser_plugins
- carbon_black_info
- carves
- certificates
- chocolatey_packages
- chrome_extensions
- cpu_info
- cpu_time
- cpuid
- crashes
- crontab
- cups_destinations
- cups_jobs
- curl
- curl_certificate
- deb_packages
- device_file
- device_firmware
- device_hash
- device_partitions
- disk_encryption
- disk_events
- disk_info
- dns_resolvers
- docker_container_labels
- docker_container_mounts
- docker_container_networks
- docker_container_ports
- docker_container_processes
- docker_container_stats
- docker_containers
- docker_image_labels
- docker_images
- docker_info
- docker_network_labels
- docker_networks
- docker_version
- docker_volume_labels
- docker_volumes
- drivers
- ec2_instance_metadata
- ec2_instance_tags
- elf_dynamic
- elf_info
- elf_sections
- elf_segments
- elf_symbols
- etc_hosts
- etc_protocols
- etc_services
- event_taps
- example
- extended_attributes
- fan_speed_sensors
- fbsd_kmods
- file
- file_events
- firefox_addons
- gatekeeper
- gatekeeper_approved_apps
- groups
- hardware_events
- hash
- homebrew_packages
- ie_extensions
- intel_me_info
- interface_addresses
- interface_details
- interface_ipv6
- iokit_devicetree
- iokit_registry
- iptables
- kernel_extensions
- kernel_info
- kernel_integrity
- kernel_modules
- kernel_panics
- keychain_acls
- keychain_items
- known_hosts
- kva_speculative_info
- last
- launchd
- launchd_overrides
- listening_ports
- lldp_neighbors
- load_average
- logged_in_users
- logical_drives
- logon_sessions
- magic
- managed_policies
- md_devices
- md_drives
- md_personalities
- mdfind
- memory_array_mapped_addresses
- memory_arrays
- memory_device_mapped_addresses
- memory_devices
- memory_error_info
- memory_info
- memory_map
- mounts
- msr
- nfs_shares
- npm_packages
- ntdomains
- ntfs_acl_permissions
- nvram
- oem_strings
- opera_extensions
- os_version
- osquery_events
- osquery_extensions
- osquery_flags
- osquery_info
- osquery_packs
- osquery_registry
- osquery_schedule
- package_bom
- package_install_history
- package_receipts
- patches
- pci_devices
- physical_disk_performance
- pipes
- pkg_packages
- platform_info
- plist
- portage_keywords
- portage_packages
- portage_use
- power_sensors
- powershell_events
- preferences
- process_envs
- process_events
- process_file_events
- process_memory_map
- process_namespaces
- process_open_files
- process_open_sockets
- processes
- programs
- prometheus_metrics
- python_packages
- quicklook_cache
- registry
- routes
- rpm_package_files
- rpm_packages
- safari_extensions
- sandboxes
- scheduled_tasks
- selinux_events
- services
- shadow
- shared_folders
- shared_memory
- shared_resources
- sharing_preferences
- shell_history
- signature
- sip_config
- smart_drive_info
- smbios_tables
- smc_keys
- socket_events
- ssh_configs
- startup_items
- sudoers
- suid_bin
- syslog_events
- system_controls
- system_info
- temperature_sensors
- time
- time_machine_backups
- time_machine_destinations
- ulimit_info
- uptime
- usb_devices
- user_events
- user_groups
- user_interaction_events
- user_ssh_keys
- users
- video_info
- virtual_memory_info
- wifi_networks
- wifi_status
- wifi_survey
- winbaseobj
- windows_crashes
- windows_events
- wmi_bios_info
- wmi_cli_event_consumers
- wmi_event_filters
- wmi_filter_consumer_binding
- wmi_script_event_consumers
- xprotect_entries
- xprotect_meta
- xprotect_reports
- yara
- yara_events
- yum_sources