fleet/handbook/queries/README.md

Standard query library

Fleet's standard query library includes a growing collection of useful queries for organizations deploying Fleet and osquery.

Queries

• Detect machines with gatekeeper disabled
• Detect presence of authorized SSH keys
• Detect hosts with the firewall disabled
• Get installed Chrome extensions
• Get installed FreeBSD software
• Get installed Homebrew packages
• Get installed Linux software
• Get installed macOS software
• Get installed Safari extensions
• Get installed Windows software
• Get laptops with failing batteries
• Get macOS disk free space percentage
• Get System Logins and Logouts
• Get wifi status
• Get Windows machines with unencrypted hard disks
• Get platform info
• Get USB devices

Contributors

Want to add your own query?

Please submit a pull request using the Fleet standard query library template.

Additional resources

Listed below are great resources that contain additional queries.

• Osquery (https://github.com/osquery/osquery/tree/master/packs)
• Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet)