Tables in FleetDM
The fleetdm plugin includes 52 tables:
Name | Description | Queries |
|---|---|---|
Apple Business (Manager) tokens used for automatic device enrollment (Fleet Premium). Token values are never returned. | ||
Audit log activities in FleetDM. | ||
Single row with the Android Enterprise Fleet uses for Android MDM. No rows when Android MDM is not set up. | ||
Apple App Store apps (VPP) from FleetDM. Lists apps available for install on teams. The API requires a team_id, so the plugin auto-discovers all teams and queries each one. Uses the /software/app_store_apps endpoint. | ||
Single-row details of the Apple Push Notification service (APNs) certificate used for Apple MDM. No rows when Apple MDM is off. | ||
macOS bootstrap package installed during automatic enrollment, per team (Fleet Premium, Apple MDM). Teams without one have no row. | ||
Information about file carving sessions in FleetDM. | ||
Certificate authorities integrated with FleetDM (Fleet Premium). | ||
Certificates Fleet requests from a certificate authority for each team's hosts, across all teams. | ||
Fleet's global configuration as a single row, one JSON column per settings section. | ||
MDM configuration profiles (OS settings) in FleetDM, across all teams. | ||
Single-row count of hosts by configuration profile (OS settings) delivery status, optionally for one team (MDM). | ||
Custom host vitals: extra host attributes that labels can target (Fleet 4.90+). | ||
Custom (secret) variables available to scripts and configuration profiles. Values are never returned. | ||
Disk encryption status counts per platform, one row per status (Fleet Premium, MDM). | ||
Enroll secrets (global and per team). These are live credentials: the table only works with expose_secrets = true in the connection config. | ||
Fleet-maintained apps available in FleetDM. These are pre-packaged software installers maintained by Fleet. Uses the /software/fleet_maintained_apps endpoint. | ||
Information about hosts managed by FleetDM. | ||
Past activities on each host (scripts run, software installed, locks, ...). Without a host_id filter every host is queried. | ||
Certificates installed on each host (macOS keychains, Windows stores, ...). Without a host_id filter every host is queried. | ||
Configuration profiles delivered to each MDM-enrolled host, with their status. Without a host_id filter every host is queried. | ||
Provides fully detailed information for each host by fetching details individually. | ||
Munki (macOS) and self-reported MDM enrollment (macOS, Windows) per host. Without a host_id filter every host is queried; hosts without such data (e.g. Linux) have no row. | ||
Scripts available to each host and their last execution. Without a host_id filter every host is queried. | ||
Software on each host, with installed versions, paths and vulnerabilities. Without a host_id filter every host is queried. | ||
Single-row summary of host counts by status and platform, optionally for one team or platform. | ||
Activities queued for each host that have not run yet. Without a host_id filter every host is queried. | ||
Pending user invitations in FleetDM. | ||
Labels used for grouping hosts in FleetDM. | ||
Label membership: one row per host in each label. Without a label_id filter every label is read. | ||
MDM commands sent to a host. host_identifier (hostname, UUID or serial) is required. | ||
Results of an MDM command on each targeted host. command_uuid is required; payload and result need expose_secrets = true. | ||
Single-row summary of MDM enrollment across hosts, optionally for one team or platform. | ||
Operating system versions from FleetDM. Lists all OS versions across managed hosts with vulnerability information. Uses the /os_versions endpoint. | ||
Query packs in FleetDM. | ||
Information about policies in FleetDM. | ||
Saved queries in FleetDM. | ||
Results stored for saved queries (reports), one row per host result row; the result itself needs expose_secrets = true. Without a query_id filter every saved query, global and per team, is read. | ||
Fleet's REST API endpoints that API-only users can be limited to (Fleet Premium, 4.90+). | ||
Single-row status of the identity provider's SCIM integration with Fleet (Fleet Premium). | ||
Saved scripts in FleetDM, across all teams. | ||
Result of a script execution. execution_id is required (see fleetdm_host_activity.script_execution_id); script_contents and output need expose_secrets = true. | ||
Software available to install during each team's setup experience (Fleet Premium). | ||
Result of a software install on a host. install_uuid is required (see fleetdm_host_activity.install_uuid); outputs need expose_secrets = true. | ||
Categories that group self-service software in Fleet Desktop, across all teams. | ||
Software titles from FleetDM. A software title groups multiple versions of the same software. Uses the /software/titles endpoint. | ||
Software versions inventory from FleetDM. Uses the /software/versions endpoint. | ||
Information about teams in FleetDM. | ||
Information about users in FleetDM. | ||
FleetDM server version and build information. | ||
Apple Volume Purchasing Program (VPP) tokens in FleetDM (Fleet Premium). Token values are never returned. | ||
CVEs affecting software and OS versions on FleetDM hosts. |