osquery-1/specs/logged_in_users.table

table_name("logged_in_users")
description("Users with an active shell on the system.")
schema([
    Column("type", TEXT, "Login type"),
    Column("user", TEXT, "User login name"),
    Column("tty", TEXT, "Device name"),
    Column("host", TEXT, "Remote hostname"),
    Column("time", INTEGER, "Time entry was made"),
    Column("pid", INTEGER, "Process (or thread) ID"),
])
extended_schema(WINDOWS, [
    Column("sid", TEXT, "The user's unique security identifier"),
    Column("registry_hive", TEXT, "HKEY_USERS registry hive"),
])
attributes(cacheable=True)
implementation("logged_in_users@genLoggedInUsers")