kibana/docs/reference/osquery-exported-fields.md

---
mapped_pages:
  - https://www.elastic.co/guide/en/kibana/current/exported-fields-osquery.html
---

# Osquery exported fields [exported-fields-osquery]

The following fields can be returned in osquery results. Note the following about osquery fields:

* Some fields list multiple descriptions because the one that applies depends on which table was queried. For example, a result stored in the `osquery.autoupdate` field may represent a response from the `firefox_addons` table or the `windows_security_center` table.
* In the cases where a field name is associated with more than one osquery table, we have made a best guess at what the data `type` should be. In the cases where it is unknown, the data type is set as a `keyword` object.

For more information about osquery tables, see the [osquery schema documentation](https://osquery.io/schema).


## Fields [osquery-fields]

**UUID** - keyword, text.text

* *system_extensions.UUID* - Extension unique id

**access** - keyword, text.text

* *ntfs_acl_permissions.access* - Specific permissions that indicate the rights described by the ACE.

**accessed_directories** - keyword, text.text

* *prefetch.accessed_directories* - Directories accessed by application within ten seconds of launch.

**accessed_directories_count** - keyword, number.long

* *prefetch.accessed_directories_count* - Number of directories accessed.

**accessed_files** - keyword, text.text

* *prefetch.accessed_files* - Files accessed by application within ten seconds of launch.

**accessed_files_count** - keyword, number.long

* *prefetch.accessed_files_count* - Number of files accessed.

**accessed_time** - keyword, number.long

* *shellbags.accessed_time* - Directory Accessed time.

**account** - keyword, text.text

* *keychain_items.account* - Optional item account

**account_id** - keyword, text.text

* *ec2_instance_metadata.account_id* - AWS account ID which owns this EC2 instance

**action** - keyword, text.text

* *disk_events.action* - Appear or disappear
* *file_events.action* - Change action (UPDATE, REMOVE, etc)
* *hardware_events.action* - Remove, insert, change properties, etc
* *ntfs_journal_events.action* - Change action (Write, Delete, etc)
* *scheduled_tasks.action* - Actions executed by the scheduled task
* *socket_events.action* - The socket action (bind, listen, close)
* *windows_firewall_rules.action* - Action for the rule or default setting
* *yara_events.action* - Change action (UPDATE, REMOVE, etc)

**activated** - keyword, number.long

* *tpm_info.activated* - TPM is activated

**active** - keyword, number.long

* *firefox_addons.active* - 1 If the addon is active else 0
* *memory_info.active* - The total amount of buffer or page cache memory, in bytes, that is in active use
* *osquery_events.active* - 1 if the publisher or subscriber is active else 0
* *osquery_packs.active* - Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.
* *osquery_registry.active* - 1 If this plugin is active else 0
* *virtual_memory_info.active* - Total number of active pages.

**active_disks** - keyword, number.long

* *md_devices.active_disks* - Number of active disks in array

**active_state** - keyword, text.text

* *systemd_units.active_state* - The high-level unit activation state, i.e. generalization of SUB

**activity** - keyword, number.long

* *unified_log.activity* - the activity ID associate with the entry

**actual** - keyword, number.long

* *fan_speed_sensors.actual* - Actual speed

**add_reason** - keyword, text.text

* *wifi_networks.add_reason* - Shows why this network was added, via menubar or command line or something else

**added_at** - keyword, number.long

* *wifi_networks.added_at* - Time this network was added as a unix_time

**additional_properties** - keyword, text.text

* *windows_search.additional_properties* - Comma separated list of columns to include in properties JSON

**address** - keyword, text.text

* *arp_cache.address* - IPv4 address target
* *dns_resolvers.address* - Resolver IP/IPv6 address
* *etc_hosts.address* - IP address mapping
* *interface_addresses.address* - Specific address for interface
* *kernel_modules.address* - Kernel module address
* *listening_ports.address* - Specific address for bind
* *platform_info.address* - Relative address of firmware mapping
* *user_events.address* - The Internet protocol address or family ID

**address_width** - keyword, text.text

* *cpu_info.address_width* - The width of the CPU address bus.

**admindir** - keyword, text.text

* *deb_packages.admindir* - libdpkg admindir. Defaults to /var/lib/dpkg

**algorithm** - keyword, text.text

* *authorized_keys.algorithm* - Key type

**alias** - keyword, text.text

* *etc_protocols.alias* - Protocol alias
* *time_machine_destinations.alias* - Human readable name of drive

**aliases** - keyword, text.text

* *etc_services.aliases* - Optional space separated list of other names for a service
* *lxd_images.aliases* - Comma-separated list of image aliases

**allow_maximum** - keyword, number.long

* *shared_resources.allow_maximum* - Number of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.

**allow_root** - keyword, text.text

* *authorizations.allow_root* - Label top-level key

**allow_signed_enabled** - keyword, number.long

* *alf.allow_signed_enabled* - 1 If allow signed mode is enabled else 0

**ambient_brightness_enabled** - keyword, text.text

* *connected_displays.ambient_brightness_enabled* - The ambient brightness setting associated with the display. This will be 1 if enabled and is 0 if disabled or not supported.

**ami_id** - keyword, text.text

* *ec2_instance_metadata.ami_id* - AMI ID used to launch this EC2 instance

**amperage** - keyword, number.long

* *battery.amperage* - The current amperage in/out of the battery in mA (positive means charging, negative means discharging)

**anonymous** - keyword, number.long

* *virtual_memory_info.anonymous* - Total number of anonymous pages.

**antispyware** - keyword, text.text

* *windows_security_center.antispyware* - Deprecated (always *Good*).

**antivirus** - keyword, text.text

* *windows_security_center.antivirus* - The health of the monitored Antivirus solution (see windows_security_products)

**api_version** - keyword, text.text

* *docker_version.api_version* - API version

**app_name** - keyword, text.text

* *windows_firewall_rules.app_name* - Friendly name of the application to which the rule applies

**apparmor** - keyword, text.text

* *apparmor_events.apparmor* - Apparmor Status like ALLOWED, DENIED etc.

**applescript_enabled** - keyword, text.text

* *apps.applescript_enabled* - Info properties NSAppleScriptEnabled label

**application** - keyword, text.text

* *office_mru.application* - Associated Office application

**arch** - keyword, text.text

* *deb_packages.arch* - Package architecture
* *docker_version.arch* - Hardware architecture
* *os_version.arch* - OS Architecture
* *rpm_packages.arch* - Architecture(s) supported
* *seccomp_events.arch* - Information about the CPU architecture
* *signature.arch* - If applicable, the arch of the signed code

**architecture** - keyword, text.text

* *docker_info.architecture* - Hardware architecture
* *ec2_instance_metadata.architecture* - Hardware architecture of this EC2 instance
* *lxd_images.architecture* - Target architecture for the image
* *lxd_instances.architecture* - Instance architecture

**architectures** - keyword, text.text

* *apt_sources.architectures* - Repository architectures

**args** - keyword, text.text

* *startup_items.args* - Arguments provided to startup executable

**arguments** - keyword, text.text

* *kernel_info.arguments* - Kernel arguments

**array_handle** - keyword, text.text

* *memory_devices.array_handle* - The memory array that the device is attached to

**assessments_enabled** - keyword, number.long

* *gatekeeper.assessments_enabled* - 1 If a Gatekeeper is enabled else 0

**asset_tag** - keyword, text.text

* *memory_devices.asset_tag* - Manufacturer specific asset tag of memory device

**atime** - keyword, number.long

* *device_file.atime* - Last access time
* *file.atime* - Last access time
* *file_events.atime* - Last access time
* *process_events.atime* - File last access in UNIX time
* *shared_memory.atime* - Attached time

**attach** - keyword, text.text

* *apparmor_profiles.attach* - Which executable(s) a profile will attach to.

**attached** - keyword, number.long

* *shared_memory.attached* - Number of attached processes

**attributes** - keyword, text.text

* *file.attributes* - File attrib string. See: [https://ss64.com/nt/attrib.html](https://ss64.com/nt/attrib.html)

**audible_alarm** - keyword, text.text

* *chassis_info.audible_alarm* - If TRUE, the frame is equipped with an audible alarm.

**audit_account_logon** - keyword, number.long

* *security_profile_info.audit_account_logon* - Determines whether the operating system MUST audit each time this computer validates the credentials of an account

**audit_account_manage** - keyword, number.long

* *security_profile_info.audit_account_manage* - Determines whether the operating system MUST audit each event of account management on a computer

**audit_ds_access** - keyword, number.long

* *security_profile_info.audit_ds_access* - Determines whether the operating system MUST audit each instance of user attempts to access an Active Directory object that has its own system access control list (SACL) specified

**audit_logon_events** - keyword, number.long

* *security_profile_info.audit_logon_events* - Determines whether the operating system MUST audit each instance of a user attempt to log on or log off this computer

**audit_object_access** - keyword, number.long

* *security_profile_info.audit_object_access* - Determines whether the operating system MUST audit each instance of user attempts to access a non-Active Directory object that has its own SACL specified

**audit_policy_change** - keyword, number.long

* *security_profile_info.audit_policy_change* - Determines whether the operating system MUST audit each instance of user attempts to change user rights assignment policy, audit policy, account policy, or trust policy

**audit_privilege_use** - keyword, number.long

* *security_profile_info.audit_privilege_use* - Determines whether the operating system MUST audit each instance of user attempts to exercise a user right

**audit_process_tracking** - keyword, number.long

* *security_profile_info.audit_process_tracking* - Determines whether the operating system MUST audit process-related events

**audit_system_events** - keyword, number.long

* *security_profile_info.audit_system_events* - Determines whether the operating system MUST audit System Change, System Startup, System Shutdown, Authentication Component Load, and Loss or Excess of Security events

**auid** - keyword

* *process_events.auid* - Audit User ID at process start
* *process_file_events.auid* - Audit user ID of the process using the file
* *seccomp_events.auid* - Audit user ID (loginuid) of the user who started the analyzed process
* *socket_events.auid* - Audit User ID
* *user_events.auid* - Audit User ID

**authenticate_user** - keyword, text.text

* *authorizations.authenticate_user* - Label top-level key

**authentication_package** - keyword, text.text

* *logon_sessions.authentication_package* - The authentication package used to authenticate the owner of the logon session.

**author** - keyword, text.text

* *chocolatey_packages.author* - Optional package author
* *chrome_extensions.author* - Optional extension author
* *npm_packages.author* - Package-supplied author
* *python_packages.author* - Optional package author
* *safari_extensions.author* - Optional extension author

**authority** - keyword, text.text

* *signature.authority* - Certificate Common Name

**authority_key_id** - keyword, text.text

* *certificates.authority_key_id* - AKID an optionally included SHA1

**authority_key_identifier** - keyword, text.text

* *curl_certificate.authority_key_identifier* - Authority Key Identifier

**authorizations** - keyword, text.text

* *keychain_acls.authorizations* - A space delimited set of authorization attributes

**auto_join** - keyword, number.long

* *wifi_networks.auto_join* - 1 if this network set to join automatically, 0 otherwise

**auto_login** - keyword, number.long

* *wifi_networks.auto_login* - 1 if auto login is enabled, 0 otherwise

**auto_update** - keyword, number.long

* *lxd_images.auto_update* - Whether the image auto-updates (1) or not (0)

**autoupdate** - keyword

* *firefox_addons.autoupdate* - 1 If the addon applies background updates else 0
* *windows_security_center.autoupdate* - The health of the Windows Autoupdate feature

**availability** - keyword, text.text

* *cpu_info.availability* - The availability and status of the CPU.

**availability_zone** - keyword, text.text

* *ec2_instance_metadata.availability_zone* - Availability zone in which this instance launched

**average** - keyword, text.text

* *load_average.average* - Load average over the specified period.

**average_memory** - keyword, number.long

* *osquery_schedule.average_memory* - Average of the bytes of resident memory left allocated after collecting results

**avg_disk_bytes_per_read** - keyword, number.long

* *physical_disk_performance.avg_disk_bytes_per_read* - Average number of bytes transferred from the disk during read operations

**avg_disk_bytes_per_write** - keyword, number.long

* *physical_disk_performance.avg_disk_bytes_per_write* - Average number of bytes transferred to the disk during write operations

**avg_disk_read_queue_length** - keyword, number.long

* *physical_disk_performance.avg_disk_read_queue_length* - Average number of read requests that were queued for the selected disk during the sample interval

**avg_disk_sec_per_read** - keyword, number.long

* *physical_disk_performance.avg_disk_sec_per_read* - Average time, in seconds, of a read operation of data from the disk

**avg_disk_sec_per_write** - keyword, number.long

* *physical_disk_performance.avg_disk_sec_per_write* - Average time, in seconds, of a write operation of data to the disk

**avg_disk_write_queue_length** - keyword, number.long

* *physical_disk_performance.avg_disk_write_queue_length* - Average number of write requests that were queued for the selected disk during the sample interval

**backup_date** - keyword, number.long

* *time_machine_backups.backup_date* - Backup Date

**bank_locator** - keyword, text.text

* *memory_devices.bank_locator* - String number of the string that identifies the physically-labeled bank where the memory device is located

**base64** - keyword, number.long

* *extended_attributes.base64* - 1 if the value is base64 encoded else 0

**base_image** - keyword, text.text

* *lxd_instances.base_image* - ID of image used to launch this instance

**base_uri** - keyword, text.text

* *apt_sources.base_uri* - Repository base URI

**baseurl** - keyword, text.text

* *yum_sources.baseurl* - Repository base URL

**basic_constraint** - keyword, text.text

* *curl_certificate.basic_constraint* - Basic Constraints

**binary_queue** - keyword, number.long

* *carbon_black_info.binary_queue* - Size in bytes of binaries waiting to be sent to Carbon Black server

**bitmap_chunk_size** - keyword, text.text

* *md_devices.bitmap_chunk_size* - Bitmap chunk size

**bitmap_external_file** - keyword, text.text

* *md_devices.bitmap_external_file* - External referenced bitmap file

**bitmap_on_mem** - keyword, text.text

* *md_devices.bitmap_on_mem* - Pages allocated in in-memory bitmap, if enabled

**block** - keyword, text.text

* *ssh_configs.block* - The host or match block

**block_size** - keyword, number.long

* *block_devices.block_size* - Block size in bytes
* *device_file.block_size* - Block size of filesystem
* *file.block_size* - Block size of filesystem

**blocks** - keyword, number.long

* *device_partitions.blocks* - Number of blocks
* *mounts.blocks* - Mounted device used blocks

**blocks_available** - keyword, number.long

* *mounts.blocks_available* - Mounted device available blocks

**blocks_free** - keyword, number.long

* *mounts.blocks_free* - Mounted device free blocks

**blocks_size** - keyword, number.long

* *device_partitions.blocks_size* - Byte size of each block
* *mounts.blocks_size* - Block size in bytes

**bluetooth_sharing** - keyword, number.long

* *sharing_preferences.bluetooth_sharing* - 1 If bluetooth sharing is enabled for any user else 0

**board_model** - keyword, text.text

* *system_info.board_model* - Board model

**board_serial** - keyword, text.text

* *system_info.board_serial* - Board serial number

**board_vendor** - keyword, text.text

* *system_info.board_vendor* - Board vendor

**board_version** - keyword, text.text

* *system_info.board_version* - Board version

**boot_partition** - keyword, number.long

* *logical_drives.boot_partition* - True if Windows booted from this drive.

**boot_uuid** - keyword, text.text

* *ibridge_info.boot_uuid* - Boot UUID of the iBridge controller

**bp_microcode_disabled** - keyword, number.long

* *kva_speculative_info.bp_microcode_disabled* - Branch Predictions are disabled due to lack of microcode update.

**bp_mitigations** - keyword, number.long

* *kva_speculative_info.bp_mitigations* - Branch Prediction mitigations are enabled.

**bp_system_pol_disabled** - keyword, number.long

* *kva_speculative_info.bp_system_pol_disabled* - Branch Predictions are disabled via system policy.

**breach_description** - keyword, text.text

* *chassis_info.breach_description* - If provided, gives a more detailed description of a detected security breach.

**bridge_nf_ip6tables** - keyword, number.long

* *docker_info.bridge_nf_ip6tables* - 1 if bridge netfilter ip6tables is enabled. 0 otherwise

**bridge_nf_iptables** - keyword, number.long

* *docker_info.bridge_nf_iptables* - 1 if bridge netfilter iptables is enabled. 0 otherwise

**broadcast** - keyword, text.text

* *interface_addresses.broadcast* - Broadcast address for the interface

**browser_type** - keyword, text.text

* *chrome_extension_content_scripts.browser_type* - The browser type (Valid values: chrome, chromium, opera, yandex, brave)
* *chrome_extensions.browser_type* - The browser type (Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta)

**bsd_flags** - keyword, text.text

* *file.bsd_flags* - The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND

**bssid** - keyword, text.text

* *wifi_status.bssid* - The current basic service set identifier
* *wifi_survey.bssid* - The current basic service set identifier

**btime** - keyword, number.long

* *file.btime* - (B)irth or (cr)eate time
* *process_events.btime* - File creation in UNIX time

**buffers** - keyword, number.long

* *memory_info.buffers* - The amount of physical RAM, in bytes, used for file buffers

**build** - keyword, text.text

* *os_version.build* - Optional build-specific or variant string

**build_distro** - keyword, text.text

* *osquery_info.build_distro* - osquery toolkit platform distribution name (os version)

**build_id** - keyword, text.text

* *sandboxes.build_id* - Sandbox-specific identifier

**build_number** - keyword, number.long

* *windows_crashes.build_number* - Windows build number of the crashing machine

**build_platform** - keyword, text.text

* *osquery_info.build_platform* - osquery toolkit build platform

**build_time** - keyword, text.text

* *docker_version.build_time* - Build time
* *portage_packages.build_time* - Unix time when package was built

**bundle_executable** - keyword, text.text

* *apps.bundle_executable* - Info properties CFBundleExecutable label

**bundle_identifier** - keyword, text.text

* *apps.bundle_identifier* - Info properties CFBundleIdentifier label
* *running_apps.bundle_identifier* - The bundle identifier of the application

**bundle_name** - keyword, text.text

* *apps.bundle_name* - Info properties CFBundleName label

**bundle_package_type** - keyword, text.text

* *apps.bundle_package_type* - Info properties CFBundlePackageType label

**bundle_path** - keyword, text.text

* *sandboxes.bundle_path* - Application bundle used by the sandbox
* *system_extensions.bundle_path* - System extension bundle path

**bundle_short_version** - keyword, text.text

* *apps.bundle_short_version* - Info properties CFBundleShortVersionString label

**bundle_version** - keyword, text.text

* *apps.bundle_version* - Info properties CFBundleVersion label
* *safari_extensions.bundle_version* - The version of the build that identifies an iteration of the bundle

**busy_state** - keyword, number.long

* *iokit_devicetree.busy_state* - 1 if the device is in a busy state else 0
* *iokit_registry.busy_state* - 1 if the node is in a busy state else 0

**bytes** - keyword, number.long

* *curl.bytes* - Number of bytes in the response
* *iptables.bytes* - Number of matching bytes for this rule.

**bytes_available** - keyword, number.long

* *time_machine_destinations.bytes_available* - Bytes available on volume

**bytes_received** - keyword, number.long

* *lxd_networks.bytes_received* - Number of bytes received on this network

**bytes_sent** - keyword, number.long

* *lxd_networks.bytes_sent* - Number of bytes sent on this network

**bytes_used** - keyword, number.long

* *time_machine_destinations.bytes_used* - Bytes used on volume

**ca** - keyword, number.long

* *certificates.ca* - 1 if CA: true (certificate is an authority) else 0

**cache_path** - keyword, text.text

* *quicklook_cache.cache_path* - Path to cache data

**cached** - keyword, number.long

* *lxd_images.cached* - Whether image is cached (1) or not (0)
* *memory_info.cached* - The amount of physical RAM, in bytes, used as cache memory

**capability** - keyword, number.long

* *apparmor_events.capability* - Capability number

**capname** - keyword, text.text

* *apparmor_events.capname* - Capability requested by the process

**caption** - keyword, text.text

* *patches.caption* - Short description of the patch.
* *windows_optional_features.caption* - Caption of feature in settings UI

**captive_login_date** - keyword, number.long

* *wifi_networks.captive_login_date* - Time this network logged in to a captive portal as unix_time

**captive_portal** - keyword, number.long

* *wifi_networks.captive_portal* - 1 if this network has a captive portal, 0 otherwise

**carve** - keyword, number.long

* *carves.carve* - Set this value to *1* to start a file carve

**carve_guid** - keyword, text.text

* *carves.carve_guid* - Identifying value of the carve session

**category** - keyword, text.text

* *apps.category* - The UTI that categorizes the app for the App Store
* *file_events.category* - The category of the file defined in the config
* *ntfs_journal_events.category* - The category that the event originated from
* *power_sensors.category* - The sensor category: currents, voltage, wattage
* *system_extensions.category* - System extension category
* *unified_log.category* - the category of the os_log_t used
* *yara_events.category* - The category of the file

**cdhash** - keyword, text.text

* *es_process_events.cdhash* - Codesigning hash of the process
* *signature.cdhash* - Hash of the application Code Directory

**celsius** - keyword, number.double

* *temperature_sensors.celsius* - Temperature in Celsius

**certificate** - keyword, text.text

* *lxd_certificates.certificate* - Certificate content

**cgroup_driver** - keyword, text.text

* *docker_info.cgroup_driver* - Control groups driver

**cgroup_namespace** - keyword, text.text

* *docker_containers.cgroup_namespace* - cgroup namespace
* *process_namespaces.cgroup_namespace* - cgroup namespace inode

**cgroup_path** - keyword, text.text

* *processes.cgroup_path* - The full hierarchical path of the process’s control group

**chain** - keyword, text.text

* *iptables.chain* - Size of module content.

**change_type** - keyword, text.text

* *docker_container_fs_changes.change_type* - Type of change: C:Modified, A:Added, D:Deleted

**channel** - keyword

* *wifi_status.channel* - Channel number
* *wifi_survey.channel* - Channel number
* *windows_eventlog.channel* - Source or channel of the event

**channel_band** - keyword, number.long

* *wifi_status.channel_band* - Channel band
* *wifi_survey.channel_band* - Channel band

**channel_width** - keyword, number.long

* *wifi_status.channel_width* - Channel width
* *wifi_survey.channel_width* - Channel width

**charged** - keyword, number.long

* *battery.charged* - 1 if the battery is currently completely charged. 0 otherwise

**charging** - keyword, number.long

* *battery.charging* - 1 if the battery is currently being charged by a power source. 0 otherwise

**chassis_types** - keyword, text.text

* *chassis_info.chassis_types* - A comma-separated list of chassis types, such as Desktop or Laptop.

**check_array_finish** - keyword, text.text

* *md_devices.check_array_finish* - Estimated duration of the check array activity

**check_array_progress** - keyword, text.text

* *md_devices.check_array_progress* - Progress of the check array activity

**check_array_speed** - keyword, text.text

* *md_devices.check_array_speed* - Speed of the check array activity

**checksum** - keyword, text.text

* *disk_events.checksum* - UDIF Master checksum if available (CRC32)

**chemistry** - keyword, text.text

* *battery.chemistry* - The battery chemistry type (eg. LiP). Some possible values are documented in [https://learn.microsoft.com/en-us/windows/win32/power/battery-information-str](https://learn.microsoft.com/en-us/windows/win32/power/battery-information-str).

**child_pid** - keyword, number.long

* *es_process_events.child_pid* - Process ID of a child process in case of a fork event

**chunk_size** - keyword, number.long

* *md_devices.chunk_size* - chunk size in bytes

**cid** - keyword, number.long

* *bpf_process_events.cid* - Cgroup ID
* *bpf_socket_events.cid* - Cgroup ID

**class** - keyword, text.text

* *authorizations.class* - Label top-level key
* *drivers.class* - Device/driver class name
* *iokit_devicetree.class* - Best matching device class (most-specific category)
* *iokit_registry.class* - Best matching device class (most-specific category)
* *usb_devices.class* - USB Device class
* *wmi_cli_event_consumers.class* - The name of the class.
* *wmi_event_filters.class* - The name of the class.
* *wmi_filter_consumer_binding.class* - The name of the class.
* *wmi_script_event_consumers.class* - The name of the class.

**clear_text_password** - keyword, number.long

* *security_profile_info.clear_text_password* - Determines whether passwords MUST be stored by using reversible encryption

**client_app_id** - keyword, text.text

* *windows_update_history.client_app_id* - Identifier of the client application that processed an update

**client_site_name** - keyword, text.text

* *ntdomains.client_site_name* - The name of the site where the domain controller is configured.

**cloud_id** - keyword, text.text

* *ycloud_instance_metadata.cloud_id* - Cloud identifier for the VM

**cmdline** - keyword, text.text

* *bpf_process_events.cmdline* - Command line arguments
* *docker_container_processes.cmdline* - Complete argv
* *es_process_events.cmdline* - Command line arguments (argv)
* *process_etw_events.cmdline* - Command Line
* *process_events.cmdline* - Command line arguments (argv)
* *processes.cmdline* - Complete argv

**cmdline_count** - keyword, number.long

* *es_process_events.cmdline_count* - Number of command line arguments

**cmdline_size** - keyword, number.long

* *process_events.cmdline_size* - Actual size (bytes) of command line arguments

**code** - keyword, text.text

* *seccomp_events.code* - The seccomp action

**code_integrity_policy_enforcement_status** - keyword, text.text

* *hvci_status.code_integrity_policy_enforcement_status* - The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.

**codename** - keyword, text.text

* *os_version.codename* - OS version codename

**codesigning_flags** - keyword, text.text

* *es_process_events.codesigning_flags* - Codesigning flags matching one of these options, in a comma separated list: NOT_VALID, ADHOC, NOT_RUNTIME, INSTALLER. See kern/cs_blobs.h in XNU for descriptions.

**collect_cross_processes** - keyword, number.long

* *carbon_black_info.collect_cross_processes* - If the sensor is configured to cross process events

**collect_data_file_writes** - keyword, number.long

* *carbon_black_info.collect_data_file_writes* - If the sensor is configured to collect non binary file writes

**collect_emet_events** - keyword, number.long

* *carbon_black_info.collect_emet_events* - If the sensor is configured to EMET events

**collect_file_mods** - keyword, number.long

* *carbon_black_info.collect_file_mods* - If the sensor is configured to collect file modification events

**collect_module_info** - keyword, number.long

* *carbon_black_info.collect_module_info* - If the sensor is configured to collect metadata of binaries

**collect_module_loads** - keyword, number.long

* *carbon_black_info.collect_module_loads* - If the sensor is configured to capture module loads

**collect_net_conns** - keyword, number.long

* *carbon_black_info.collect_net_conns* - If the sensor is configured to collect network connections

**collect_process_user_context** - keyword, number.long

* *carbon_black_info.collect_process_user_context* - If the sensor is configured to collect the user running a process

**collect_processes** - keyword, number.long

* *carbon_black_info.collect_processes* - If the sensor is configured to process events

**collect_reg_mods** - keyword, number.long

* *carbon_black_info.collect_reg_mods* - If the sensor is configured to collect registry modification events

**collect_sensor_operations** - keyword, number.long

* *carbon_black_info.collect_sensor_operations* - Unknown

**collect_store_files** - keyword, number.long

* *carbon_black_info.collect_store_files* - If the sensor is configured to send back binaries to the Carbon Black server

**collisions** - keyword, number.long

* *interface_details.collisions* - Packet Collisions detected

**color_depth** - keyword, number.long

* *video_info.color_depth* - The amount of bits per pixel to represent color.

**comm** - keyword, text.text

* *apparmor_events.comm* - Command-line name of the command that was used to invoke the analyzed process
* *seccomp_events.comm* - Command-line name of the command that was used to invoke the analyzed process

**command** - keyword, text.text

* *crontab.command* - Raw command string
* *docker_containers.command* - Command with arguments
* *shell_history.command* - Unparsed date/line/command history line

**command_line** - keyword, text.text

* *windows_crashes.command_line* - Command-line string passed to the crashed process

**command_line_template** - keyword, text.text

* *wmi_cli_event_consumers.command_line_template* - Standard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.

**comment** - keyword, text.text

* *authorizations.comment* - Label top-level key
* *authorized_keys.comment* - Optional comment
* *docker_image_history.comment* - Instruction comment
* *etc_protocols.comment* - Comment with protocol description
* *etc_services.comment* - Optional comment for a service.
* *groups.comment* - Remarks or comments associated with the group
* *keychain_items.comment* - Optional keychain comment

**common_name** - keyword, text.text

* *certificates.common_name* - Certificate CommonName
* *curl_certificate.common_name* - Common name of company issued to

**compat** - keyword, number.long

* *seccomp_events.compat* - Is system call in compatibility mode

**compiler** - keyword, text.text

* *apps.compiler* - Info properties DTCompiler label

**completed_time** - keyword, number.long

* *cups_jobs.completed_time* - When the job completed printing

**components** - keyword, text.text

* *apt_sources.components* - Repository components

**compressed** - keyword, number.long

* *virtual_memory_info.compressed* - The total number of pages that have been compressed by the VM compressor.

**compressor** - keyword, number.long

* *virtual_memory_info.compressor* - The number of pages used to store compressed VM pages.

**computer_name** - keyword, text.text

* *system_info.computer_name* - Friendly computer name (optional)
* *windows_eventlog.computer_name* - Hostname of system where event was generated
* *windows_events.computer_name* - Hostname of system where event was generated

**condition** - keyword, text.text

* *battery.condition* - One of the following: "Normal" indicates the condition of the battery is within normal tolerances, "Service Needed" indicates that the battery should be checked out by a licensed Mac repair service, "Permanent Failure" indicates the battery needs replacement

**config_entrypoint** - keyword, text.text

* *docker_containers.config_entrypoint* - Container entrypoint(s)

**config_flag** - keyword, text.text

* *sip_config.config_flag* - The System Integrity Protection config flag

**config_hash** - keyword, text.text

* *osquery_info.config_hash* - Hash of the working configuration state

**config_name** - keyword, text.text

* *carbon_black_info.config_name* - Sensor group

**config_valid** - keyword, number.long

* *osquery_info.config_valid* - 1 if the config was loaded and considered valid, else 0

**config_value** - keyword, text.text

* *system_controls.config_value* - The MIB value set in /etc/sysctl.conf

**configured_clock_speed** - keyword, number.long

* *memory_devices.configured_clock_speed* - Configured speed of memory device in megatransfers per second (MT/s)

**configured_voltage** - keyword, number.long

* *memory_devices.configured_voltage* - Configured operating voltage of device in millivolts

**connection_id** - keyword, text.text

* *interface_details.connection_id* - Name of the network connection as it appears in the Network Connections Control Panel program.

**connection_status** - keyword, text.text

* *interface_details.connection_status* - State of the network adapter connection to the network.

**connection_type** - keyword, text.text

* *connected_displays.connection_type* - The connection type associated with the display.

**consistency_scan_date** - keyword, number.long

* *time_machine_destinations.consistency_scan_date* - Consistency scan date

**consumer** - keyword, text.text

* *wmi_filter_consumer_binding.consumer* - Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.

**containers** - keyword, number.long

* *docker_info.containers* - Total number of containers

**containers_paused** - keyword, number.long

* *docker_info.containers_paused* - Number of containers in paused state

**containers_running** - keyword, number.long

* *docker_info.containers_running* - Number of containers currently running

**containers_stopped** - keyword, number.long

* *docker_info.containers_stopped* - Number of containers in stopped state

**content** - keyword, text.text

* *disk_events.content* - Disk event content

**content_caching** - keyword, number.long

* *sharing_preferences.content_caching* - 1 If content caching is enabled else 0

**content_type** - keyword, text.text

* *package_install_history.content_type* - Package content_type (optional)

**conversion_status** - keyword, number.long

* *bitlocker_info.conversion_status* - The bitlocker conversion status of the drive.

**coprocessor_version** - keyword, text.text

* *ibridge_info.coprocessor_version* - The manufacturer and chip version

**copy** - keyword, number.long

* *virtual_memory_info.copy* - Total number of copy-on-write pages.

**copyright** - keyword, text.text

* *apps.copyright* - Info properties NSHumanReadableCopyright label
* *safari_extensions.copyright* - A human-readable copyright notice for the bundle

**core** - keyword, number.long

* *cpu_time.core* - Name of the cpu (core)

**cosine_similarity** - keyword, number.double

* *powershell_events.cosine_similarity* - How similar the Powershell script is to a provided *normal* character frequency

**count** - keyword, number.long

* *userassist.count* - Number of times the application has been executed.
* *yara.count* - Number of YARA matches
* *yara_events.count* - Number of YARA matches

**country_code** - keyword, text.text

* *wifi_status.country_code* - The country code (ISO/IEC 3166-1:1997) for the network
* *wifi_survey.country_code* - The country code (ISO/IEC 3166-1:1997) for the network

**cpu** - keyword, number.double

* *docker_container_processes.cpu* - CPU utilization as percentage

**cpu_brand** - keyword, text.text

* *system_info.cpu_brand* - CPU brand string, contains vendor and model

**cpu_cfs_period** - keyword, number.long

* *docker_info.cpu_cfs_period* - 1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise

**cpu_cfs_quota** - keyword, number.long

* *docker_info.cpu_cfs_quota* - 1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise

**cpu_kernelmode_usage** - keyword, number.long

* *docker_container_stats.cpu_kernelmode_usage* - CPU kernel mode usage

**cpu_logical_cores** - keyword, number.long

* *system_info.cpu_logical_cores* - Number of logical CPU cores available to the system

**cpu_microcode** - keyword, text.text

* *system_info.cpu_microcode* - Microcode version

**cpu_physical_cores** - keyword, number.long

* *system_info.cpu_physical_cores* - Number of physical CPU cores in to the system

**cpu_pred_cmd_supported** - keyword, number.long

* *kva_speculative_info.cpu_pred_cmd_supported* - PRED_CMD MSR supported by CPU Microcode.

**cpu_set** - keyword, number.long

* *docker_info.cpu_set* - 1 if CPU set selection support is enabled. 0 otherwise

**cpu_shares** - keyword, number.long

* *docker_info.cpu_shares* - 1 if CPU share weighting support is enabled. 0 otherwise

**cpu_sockets** - keyword, number.long

* *system_info.cpu_sockets* - Number of processor sockets in the system

**cpu_spec_ctrl_supported** - keyword, number.long

* *kva_speculative_info.cpu_spec_ctrl_supported* - SPEC_CTRL MSR supported by CPU Microcode.

**cpu_status** - keyword, number.long

* *cpu_info.cpu_status* - The current operating status of the CPU.

**cpu_subtype** - keyword

* *processes.cpu_subtype* - Indicates the specific processor on which an entry may be used.
* *system_info.cpu_subtype* - CPU subtype

**cpu_total_usage** - keyword, number.long

* *docker_container_stats.cpu_total_usage* - Total CPU usage

**cpu_type** - keyword

* *processes.cpu_type* - Indicates the specific processor designed for installation.
* *system_info.cpu_type* - CPU type

**cpu_usermode_usage** - keyword, number.long

* *docker_container_stats.cpu_usermode_usage* - CPU user mode usage

**cpus** - keyword, number.long

* *docker_info.cpus* - Number of CPUs

**crash_path** - keyword, text.text

* *crashes.crash_path* - Location of log file
* *windows_crashes.crash_path* - Path of the log file

**crashed_thread** - keyword, number.long

* *crashes.crashed_thread* - Thread ID which crashed

**created** - keyword, text.text

* *authorizations.created* - Label top-level key
* *docker_containers.created* - Time of creation as UNIX time
* *docker_image_history.created* - Time of creation as UNIX time
* *docker_images.created* - Time of creation as UNIX time
* *docker_networks.created* - Time of creation as UNIX time
* *keychain_items.created* - Date item was created

**created_at** - keyword, text.text

* *lxd_images.created_at* - ISO time of image creation
* *lxd_instances.created_at* - ISO time of creation

**created_by** - keyword, text.text

* *docker_image_history.created_by* - Created by instruction

**created_time** - keyword, number.long

* *shellbags.created_time* - Directory Created time.

**creation_time** - keyword

* *account_policy_data.creation_time* - When the account was first created
* *cups_jobs.creation_time* - When the print request was initiated

**creator** - keyword, text.text

* *firefox_addons.creator* - Addon-supported creator string

**creator_pid** - keyword, number.long

* *shared_memory.creator_pid* - Process ID that created the segment

**creator_uid** - keyword, number.long

* *shared_memory.creator_uid* - User ID of creator process

**csname** - keyword, text.text

* *patches.csname* - The name of the host the patch is installed on.

**ctime** - keyword

* *device_file.ctime* - Creation time
* *file.ctime* - Last status change time
* *file_events.ctime* - Last status change time
* *gatekeeper_approved_apps.ctime* - Last change time
* *process_events.ctime* - File last metadata change in UNIX time
* *shared_memory.ctime* - Changed time

**current_capacity** - keyword, number.long

* *battery.current_capacity* - The battery’s current capacity (level of charge) in mAh

**current_clock_speed** - keyword, number.long

* *cpu_info.current_clock_speed* - The current frequency of the CPU.

**current_directory** - keyword, text.text

* *windows_crashes.current_directory* - Current working directory of the crashed process

**current_disk_queue_length** - keyword, number.long

* *physical_disk_performance.current_disk_queue_length* - Number of requests outstanding on the disk at the time the performance data is collected

**current_locale** - keyword, text.text

* *chrome_extensions.current_locale* - Current locale supported by extension

**current_value** - keyword, text.text

* *system_controls.current_value* - Value of setting

**cwd** - keyword, text.text

* *bpf_process_events.cwd* - Current working directory
* *es_process_events.cwd* - The process current working directory
* *process_events.cwd* - The process current working directory
* *process_file_events.cwd* - The current working directory of the process
* *processes.cwd* - Process current working directory

**cycle_count** - keyword, number.long

* *battery.cycle_count* - The number of charge/discharge cycles

**data** - keyword, text.text

* *magic.data* - Magic number data from libmagic
* *registry.data* - Data content of registry value
* *windows_eventlog.data* - Data associated with the event
* *windows_events.data* - Data associated with the event

**data_width** - keyword, number.long

* *memory_devices.data_width* - Data width, in bits, of this memory device

**database** - keyword, number.long

* *lxd_cluster_members.database* - Whether the server is a database node (1) or not (0)

**date** - keyword

* *drivers.date* - Driver date
* *platform_info.date* - Self-reported platform code update date
* *windows_update_history.date* - Date and the time an update was applied

**date_created** - keyword, number.long

* *windows_search.date_created* - The unix timestamp of when the item was created.

**date_modified** - keyword, number.long

* *windows_search.date_modified* - The unix timestamp of when the item was last modified

**datetime** - keyword, text.text

* *crashes.datetime* - Date/Time at which the crash occurred
* *powershell_events.datetime* - System time at which the Powershell script event occurred
* *process_etw_events.datetime* - Event timestamp in DATETIME format
* *syslog_events.datetime* - Time known to syslog
* *time.datetime* - Current date and time (ISO format) in UTC
* *windows_crashes.datetime* - Timestamp (log format) of the crash
* *windows_eventlog.datetime* - System time at which the event occurred
* *windows_events.datetime* - System time at which the event occurred

**day** - keyword, number.long

* *time.day* - Current day in UTC

**day_of_month** - keyword, text.text

* *crontab.day_of_month* - The day of the month for the job

**day_of_week** - keyword, text.text

* *crontab.day_of_week* - The day of the week for the job

**days** - keyword, number.long

* *uptime.days* - Days of uptime

**dc_site_name** - keyword, text.text

* *ntdomains.dc_site_name* - The name of the site where the domain controller is located.

**decompressed** - keyword, number.long

* *virtual_memory_info.decompressed* - The total number of pages that have been decompressed by the VM compressor.

**default_locale** - keyword, text.text

* *chrome_extensions.default_locale* - Default locale supported by extension

**default_value** - keyword, text.text

* *osquery_flags.default_value* - Flag default value

**denied_mask** - keyword, text.text

* *apparmor_events.denied_mask* - Denied permissions for the process

**denylisted** - keyword, number.long

* *osquery_schedule.denylisted* - 1 if the query is denylisted else 0

**dependencies** - keyword, text.text

* *kernel_panics.dependencies* - Module dependencies existing in crashed module’s backtrace

**depth** - keyword, number.long

* *iokit_devicetree.depth* - Device nested depth
* *iokit_registry.depth* - Node nested depth

**description** - keyword, text.text

* *appcompat_shims.description* - Description of the SDB.
* *browser_plugins.description* - Plugin description text
* *chassis_info.description* - An extended description of the chassis if available.
* *chrome_extensions.description* - Extension-optional description
* *disk_info.description* - The OS’s description of the disk.
* *drivers.description* - Driver description
* *firefox_addons.description* - Addon-supplied description string
* *interface_details.description* - Short description of the object a one-line string.
* *kernel_keys.description* - The key description.
* *keychain_acls.description* - The description included with the ACL entry
* *keychain_items.description* - Optional item description
* *logical_drives.description* - The canonical description of the drive, e.g. *Logical Fixed Disk*, *CD-ROM Disk*.
* *lxd_images.description* - Image description
* *lxd_instances.description* - Instance description
* *npm_packages.description* - Package-supplied description
* *osquery_flags.description* - Flag description
* *patches.description* - Fuller description of the patch.
* *safari_extensions.description* - Optional extension description text
* *secureboot.description* - (Apple Silicon) Human-readable description: *Full Security*, *Reduced Security*, or *Permissive Security*
* *services.description* - Service Description
* *shared_resources.description* - A textual description of the object
* *smbios_tables.description* - Table entry description
* *systemd_units.description* - Unit description
* *users.description* - Optional user description
* *windows_update_history.description* - Description of an update
* *ycloud_instance_metadata.description* - Description of the VM

**designed_capacity** - keyword, number.long

* *battery.designed_capacity* - The battery’s designed capacity in mAh

**dest_filename** - keyword, text.text

* *es_process_file_events.dest_filename* - Destination filename for the event

**dest_path** - keyword, text.text

* *process_file_events.dest_path* - The canonical path associated with the event

**destination** - keyword, text.text

* *cups_jobs.destination* - The printer the job was sent to
* *docker_container_mounts.destination* - Destination path inside container
* *routes.destination* - Destination IP address

**destination_id** - keyword, text.text

* *time_machine_backups.destination_id* - Time Machine destination ID
* *time_machine_destinations.destination_id* - Time Machine destination ID

**dev_id_enabled** - keyword, number.long

* *gatekeeper.dev_id_enabled* - 1 If a Gatekeeper allows execution from identified developers else 0

**developer_id** - keyword, text.text

* *safari_extensions.developer_id* - Optional developer identifier
* *xprotect_meta.developer_id* - Developer identity (SHA1) of extension

**development_region** - keyword, text.text

* *apps.development_region* - Info properties CFBundleDevelopmentRegion label
* *browser_plugins.development_region* - Plugin language-localization

**device** - keyword, text.text

* *device_file.device* - Absolute file path to device node
* *device_firmware.device* - The device name
* *device_hash.device* - Absolute file path to device node
* *device_partitions.device* - Absolute file path to device node
* *disk_events.device* - Disk event BSD name
* *file.device* - Device ID (optional)
* *kernel_info.device* - Kernel device identifier
* *lxd_instance_devices.device* - Name of the device
* *mounts.device* - Mounted device
* *process_memory_map.device* - MA:MI Major/minor device ID

**device_alias** - keyword, text.text

* *mounts.device_alias* - Mounted device alias

**device_error_address** - keyword, text.text

* *memory_error_info.device_error_address* - 32 bit physical address of the error relative to the start of the failing memory address, in bytes

**device_id** - keyword, text.text

* *bitlocker_info.device_id* - ID of the encrypted drive.
* *cpu_info.device_id* - The DeviceID of the CPU.
* *drivers.device_id* - Device ID
* *logical_drives.device_id* - The drive id, usually the drive name, e.g., *C:*.

**device_locator** - keyword, text.text

* *memory_devices.device_locator* - String number of the string that identifies the physically-labeled socket or board position where the memory device is located

**device_name** - keyword, text.text

* *drivers.device_name* - Device name
* *md_devices.device_name* - md device name

**device_path** - keyword, text.text

* *iokit_devicetree.device_path* - Device tree path

**device_type** - keyword, text.text

* *lxd_instance_devices.device_type* - Device type

**dhcp_enabled** - keyword, number.long

* *interface_details.dhcp_enabled* - If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.

**dhcp_lease_expires** - keyword, text.text

* *interface_details.dhcp_lease_expires* - Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.

**dhcp_lease_obtained** - keyword, text.text

* *interface_details.dhcp_lease_obtained* - Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server.

**dhcp_server** - keyword, text.text

* *interface_details.dhcp_server* - IP address of the dynamic host configuration protocol (DHCP) server.

**direction** - keyword, text.text

* *windows_firewall_rules.direction* - Direction of traffic for which the rule applies

**directory** - keyword, text.text

* *extended_attributes.directory* - Directory of file(s)
* *file.directory* - Directory of file(s)
* *hash.directory* - Must provide a path or directory
* *npm_packages.directory* - Directory where node_modules are located
* *python_packages.directory* - Directory where Python modules are located
* *users.directory* - User’s home directory

**disabled** - keyword

* *browser_plugins.disabled* - Is the plugin disabled. 1 = Disabled
* *firefox_addons.disabled* - 1 If the addon is application-disabled else 0
* *launchd.disabled* - Skip loading this daemon or agent on boot
* *wifi_networks.disabled* - 1 if this network is disabled, 0 otherwise

**disc_sharing** - keyword, number.long

* *sharing_preferences.disc_sharing* - 1 If CD or DVD sharing is enabled else 0

**disconnected** - keyword, number.long

* *connectivity.disconnected* - True if the all interfaces are not connected to any network

**discovery_cache_hits** - keyword, number.long

* *osquery_packs.discovery_cache_hits* - The number of times that the discovery query used cached values since the last time the config was reloaded

**discovery_executions** - keyword, number.long

* *osquery_packs.discovery_executions* - The number of times that the discovery queries have been executed since the last time the config was reloaded

**disk_bytes_read** - keyword, number.long

* *processes.disk_bytes_read* - Bytes read from disk

**disk_bytes_written** - keyword, number.long

* *processes.disk_bytes_written* - Bytes written to disk

**disk_index** - keyword, number.long

* *disk_info.disk_index* - Physical drive number of the disk.

**disk_read** - keyword, number.long

* *docker_container_stats.disk_read* - Total disk read bytes

**disk_size** - keyword, number.long

* *disk_info.disk_size* - Size of the disk.

**disk_write** - keyword, number.long

* *docker_container_stats.disk_write* - Total disk write bytes

**display_id** - keyword, text.text

* *connected_displays.display_id* - The display ID.

**display_name** - keyword, text.text

* *apps.display_name* - Info properties CFBundleDisplayName label
* *services.display_name* - Service Display name

**display_type** - keyword, text.text

* *connected_displays.display_type* - The type of display.

**dns_domain** - keyword, text.text

* *interface_details.dns_domain* - Organization name followed by a period and an extension that indicates the type of organization, such as *microsoft.com*.

**dns_domain_name** - keyword, text.text

* *logon_sessions.dns_domain_name* - The DNS name for the owner of the logon session.

**dns_domain_suffix_search_order** - keyword, text.text

* *interface_details.dns_domain_suffix_search_order* - Array of DNS domain suffixes to be appended to the end of host names during name resolution.

**dns_forest_name** - keyword, text.text

* *ntdomains.dns_forest_name* - The name of the root of the DNS tree.

**dns_host_name** - keyword, text.text

* *interface_details.dns_host_name* - Host name used to identify the local computer for authentication by some utilities.

**dns_server_search_order** - keyword, text.text

* *interface_details.dns_server_search_order* - Array of server IP addresses to be used in querying for DNS servers.

**domain** - keyword, text.text

* *ad_config.domain* - Active Directory trust domain
* *managed_policies.domain* - System or manager-chosen domain key
* *preferences.domain* - Application ID usually in com.name.product format

**domain_controller_address** - keyword, text.text

* *ntdomains.domain_controller_address* - The IP Address of the discovered domain controller..

**domain_controller_name** - keyword, text.text

* *ntdomains.domain_controller_name* - The name of the discovered domain controller.

**domain_name** - keyword, text.text

* *ntdomains.domain_name* - The name of the domain.

**drive_letter** - keyword, text.text

* *bitlocker_info.drive_letter* - Drive letter of the encrypted drive.
* *ntfs_journal_events.drive_letter* - The drive letter identifying the source journal

**drive_name** - keyword, text.text

* *md_drives.drive_name* - Drive device name

**driver** - keyword, text.text

* *docker_container_mounts.driver* - Driver providing the mount
* *docker_networks.driver* - Network driver
* *docker_volumes.driver* - Volume driver
* *hardware_events.driver* - Driver claiming the device
* *lxd_storage_pools.driver* - Storage driver
* *pci_devices.driver* - PCI Device used driver
* *video_info.driver* - The driver of the device.

**driver_date** - keyword, number.long

* *video_info.driver_date* - The date listed on the installed driver.

**driver_key** - keyword, text.text

* *drivers.driver_key* - Driver key

**driver_version** - keyword, text.text

* *video_info.driver_version* - The version of the installed driver.

**dst_ip** - keyword, text.text

* *iptables.dst_ip* - Destination IP address.

**dst_mask** - keyword, text.text

* *iptables.dst_mask* - Destination IP address mask.

**dst_port** - keyword, text.text

* *iptables.dst_port* - Protocol destination port(s).

**dtime** - keyword, number.long

* *shared_memory.dtime* - Detached time

**dump_certificate** - keyword, number.long

* *curl_certificate.dump_certificate* - Set this value to *1* to dump certificate

**duration** - keyword, number.long

* *bpf_process_events.duration* - How much time was spent inside the syscall (nsecs)
* *bpf_socket_events.duration* - How much time was spent inside the syscall (nsecs)

**eapi** - keyword, number.long

* *portage_packages.eapi* - The eapi for the ebuild

**egid** - keyword

* *docker_container_processes.egid* - Effective group ID
* *es_process_events.egid* - Effective Group ID of the process
* *process_events.egid* - Effective group ID at process start
* *process_file_events.egid* - Effective group ID of the process using the file
* *processes.egid* - Unsigned effective group ID

**eid** - keyword, text.text

* *apparmor_events.eid* - Event ID
* *bpf_process_events.eid* - Event ID
* *bpf_socket_events.eid* - Event ID
* *disk_events.eid* - Event ID
* *es_process_events.eid* - Event ID
* *es_process_file_events.eid* - Event ID
* *file_events.eid* - Event ID
* *hardware_events.eid* - Event ID
* *ntfs_journal_events.eid* - Event ID
* *process_etw_events.eid* - Event ID
* *process_events.eid* - Event ID
* *process_file_events.eid* - Event ID
* *selinux_events.eid* - Event ID
* *socket_events.eid* - Event ID
* *syslog_events.eid* - Event ID
* *user_events.eid* - Event ID
* *windows_events.eid* - Event ID
* *yara_events.eid* - Event ID

**ejectable** - keyword, number.long

* *disk_events.ejectable* - 1 if ejectable, 0 if not

**elapsed_time** - keyword, number.long

* *processes.elapsed_time* - Elapsed time in seconds this process has been running.

**element** - keyword, text.text

* *apps.element* - Does the app identify as a background agent

**elevated_token** - keyword, number.long

* *processes.elevated_token* - Process uses elevated token yes=1, no=0

**enable_admin_account** - keyword, number.long

* *security_profile_info.enable_admin_account* - Determines whether the Administrator account on the local computer is enabled

**enable_guest_account** - keyword, number.long

* *security_profile_info.enable_guest_account* - Determines whether the Guest account on the local computer is enabled

**enable_ipv6** - keyword, number.long

* *docker_networks.enable_ipv6* - 1 if IPv6 is enabled on this network. 0 otherwise

**enabled** - keyword

* *app_schemes.enabled* - 1 if this handler is the OS default, else 0
* *event_taps.enabled* - Is the Event Tap enabled
* *interface_details.enabled* - Indicates whether the adapter is enabled or not.
* *location_services.enabled* - 1 if Location Services are enabled, else 0
* *lxd_cluster.enabled* - Whether clustering enabled (1) or not (0) on this node
* *sandboxes.enabled* - Application sandboxings enabled on container
* *scheduled_tasks.enabled* - Whether or not the scheduled task is enabled
* *screenlock.enabled* - 1 If a password is required after sleep or the screensaver begins; else 0
* *sip_config.enabled* - 1 if this configuration is enabled, otherwise 0
* *tpm_info.enabled* - TPM is enabled
* *windows_firewall_rules.enabled* - 1 if the rule is enabled
* *yum_sources.enabled* - Whether the repository is used

**enabled_nvram** - keyword, number.long

* *sip_config.enabled_nvram* - 1 if this configuration is enabled, otherwise 0

**encrypted** - keyword, number.long

* *disk_encryption.encrypted* - 1 If encrypted: true (disk is encrypted), else 0
* *user_ssh_keys.encrypted* - 1 if key is encrypted, 0 otherwise

**encryption** - keyword, text.text

* *time_machine_destinations.encryption* - Last known encrypted state

**encryption_method** - keyword, text.text

* *bitlocker_info.encryption_method* - The encryption type of the device.

**encryption_status** - keyword, text.text

* *disk_encryption.encryption_status* - Disk encryption status with one of following values: encrypted | not encrypted | undefined

**end** - keyword, text.text

* *memory_map.end* - End address of memory region
* *process_memory_map.end* - Virtual end address (hex)

**ending_address** - keyword, text.text

* *memory_array_mapped_addresses.ending_address* - Physical ending address of last kilobyte of a range of memory mapped to physical memory array
* *memory_device_mapped_addresses.ending_address* - Physical ending address of last kilobyte of a range of memory mapped to physical memory array

**endpoint_id** - keyword, text.text

* *docker_container_networks.endpoint_id* - Endpoint ID

**entry** - keyword, text.text

* *authorization_mechanisms.entry* - The whole string entry
* *shimcache.entry* - Execution order.

**env** - keyword, text.text

* *es_process_events.env* - Environment variables delimited by spaces
* *process_events.env* - Environment variables delimited by spaces

**env_count** - keyword, number.long

* *es_process_events.env_count* - Number of environment variables
* *process_events.env_count* - Number of environment variables

**env_size** - keyword, number.long

* *process_events.env_size* - Actual size (bytes) of environment list

**env_variables** - keyword, text.text

* *docker_containers.env_variables* - Container environmental variables

**environment** - keyword, text.text

* *apps.environment* - Application-set environment variables

**ephemeral** - keyword, number.long

* *lxd_instances.ephemeral* - Whether the instance is ephemeral(1) or not(0)

**epoch** - keyword, number.long

* *rpm_packages.epoch* - Package epoch value

**error** - keyword, text.text

* *apparmor_events.error* - Error information

**error_granularity** - keyword, text.text

* *memory_error_info.error_granularity* - Granularity to which the error can be resolved

**error_operation** - keyword, text.text

* *memory_error_info.error_operation* - Memory access operation that caused the error

**error_resolution** - keyword, text.text

* *memory_error_info.error_resolution* - Range, in bytes, within which this error can be determined, when an error address is given

**error_type** - keyword, text.text

* *memory_error_info.error_type* - type of error associated with current error status for array or device

**euid** - keyword

* *docker_container_processes.euid* - Effective user ID
* *es_process_events.euid* - Effective User ID of the process
* *process_events.euid* - Effective user ID at process start
* *process_file_events.euid* - Effective user ID of the process using the file
* *processes.euid* - Unsigned effective user ID

**event** - keyword, text.text

* *crontab.event* - The job @event name (rare)

**event_queue** - keyword, number.long

* *carbon_black_info.event_queue* - Size in bytes of Carbon Black event files on disk

**event_tap_id** - keyword, number.long

* *event_taps.event_tap_id* - Unique ID for the Tap

**event_tapped** - keyword, text.text

* *event_taps.event_tapped* - The mask that identifies the set of events to be observed.

**event_type** - keyword, text.text

* *es_process_events.event_type* - Type of EndpointSecurity event
* *es_process_file_events.event_type* - Type of EndpointSecurity event

**eventid** - keyword, number.long

* *windows_eventlog.eventid* - Event ID of the event
* *windows_events.eventid* - Event ID of the event

**events** - keyword, number.long

* *osquery_events.events* - Number of events emitted or received since osquery started

**exception_address** - keyword, text.text

* *windows_crashes.exception_address* - Address (in hex) where the exception occurred

**exception_code** - keyword, text.text

* *windows_crashes.exception_code* - The Windows exception code

**exception_codes** - keyword, text.text

* *crashes.exception_codes* - Exception codes from the crash

**exception_message** - keyword, text.text

* *windows_crashes.exception_message* - The NTSTATUS error message associated with the exception code

**exception_notes** - keyword, text.text

* *crashes.exception_notes* - Exception notes from the crash

**exception_type** - keyword, text.text

* *crashes.exception_type* - Exception type of the crash

**exe** - keyword, text.text

* *seccomp_events.exe* - The path to the executable that was used to invoke the analyzed process

**executable** - keyword, text.text

* *appcompat_shims.executable* - Name of the executable that is being shimmed. This is pulled from the registry.
* *process_file_events.executable* - The executable path

**executable_path** - keyword, text.text

* *wmi_cli_event_consumers.executable_path* - Module to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.

**execution_flag** - keyword, number.long

* *shimcache.execution_flag* - Boolean Execution flag, 1 for execution, 0 for no execution, -1 for missing (this flag does not exist on Windows 10 and higher).

**executions** - keyword, number.long

* *osquery_schedule.executions* - Number of times the query was executed

**exit_code** - keyword, text.text

* *bpf_process_events.exit_code* - Exit code of the system call
* *bpf_socket_events.exit_code* - Exit code of the system call
* *es_process_events.exit_code* - Exit code of a process in case of an exit event
* *process_etw_events.exit_code* - Exit Code - Present only on ProcessStop events

**expand** - keyword, number.long

* *default_environment.expand* - 1 if the variable needs expanding, 0 otherwise

**expire** - keyword, number.long

* *shadow.expire* - Number of days since UNIX epoch date until account is disabled

**expires_at** - keyword, text.text

* *lxd_images.expires_at* - ISO time of image expiration

**extended_key_usage** - keyword, text.text

* *curl_certificate.extended_key_usage* - Extended usage of key in certificate

**extension_type** - keyword, text.text

* *safari_extensions.extension_type* - Extension Type: WebOrAppExtension or LegacyExtension

**extensions** - keyword, text.text

* *osquery_info.extensions* - osquery extensions status

**external** - keyword, number.long

* *app_schemes.external* - 1 if this handler does NOT exist on macOS by default, else 0

**extra** - keyword, text.text

* *asl.extra* - Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.
* *os_version.extra* - Optional extra release specification
* *platform_info.extra* - Platform-specific additional information

**facility** - keyword, text.text

* *asl.facility* - Sender’s facility.  Default is *user*.
* *syslog_events.facility* - Syslog facility

**fahrenheit** - keyword, number.double

* *temperature_sensors.fahrenheit* - Temperature in Fahrenheit

**failed_disks** - keyword, number.long

* *md_devices.failed_disks* - Number of failed disks in array

**failed_login_count** - keyword, number.long

* *account_policy_data.failed_login_count* - The number of failed login attempts using an incorrect password. Count resets after a correct password is entered.

**failed_login_timestamp** - keyword, number.double

* *account_policy_data.failed_login_timestamp* - The time of the last failed login attempt. Resets after a correct password is entered

**family** - keyword, number.long

* *bpf_socket_events.family* - The Internet protocol family ID
* *listening_ports.family* - Network protocol (IPv4, IPv6)
* *process_open_sockets.family* - Network protocol (IPv4, IPv6)
* *socket_events.family* - The Internet protocol family ID

**fan** - keyword, text.text

* *fan_speed_sensors.fan* - Fan number

**faults** - keyword, number.long

* *virtual_memory_info.faults* - Total number of calls to vm_faults.

**fd** - keyword, text.text

* *bpf_socket_events.fd* - The file description for the process socket
* *listening_ports.fd* - Socket file descriptor number
* *process_open_files.fd* - Process-specific file descriptor number
* *process_open_pipes.fd* - File descriptor
* *process_open_sockets.fd* - Socket file descriptor number
* *socket_events.fd* - The file description for the process socket

**feature** - keyword, text.text

* *cpuid.feature* - Present feature flags

**feature_control** - keyword, number.long

* *msr.feature_control* - Bitfield controlling enabled features.

**field_name** - keyword, text.text

* *system_controls.field_name* - Specific attribute of opaque type

**file_attributes** - keyword, text.text

* *ntfs_journal_events.file_attributes* - File attributes

**file_backed** - keyword, number.long

* *virtual_memory_info.file_backed* - Total number of file backed pages.

**file_id** - keyword, text.text

* *file.file_id* - file ID

**file_sharing** - keyword, number.long

* *sharing_preferences.file_sharing* - 1 If file sharing is enabled else 0

**file_system** - keyword, text.text

* *logical_drives.file_system* - The file system of the drive.

**file_version** - keyword, text.text

* *file.file_version* - File version

**filename** - keyword, text.text

* *device_file.filename* - Name portion of file path
* *es_process_file_events.filename* - The source or target filename for the event
* *file.filename* - Name portion of file path
* *lxd_images.filename* - Filename of the image file
* *prefetch.filename* - Executable filename.
* *xprotect_entries.filename* - Use this file name to match

**filepath** - keyword, text.text

* *package_bom.filepath* - Package file or directory

**filesystem** - keyword, text.text

* *disk_events.filesystem* - Filesystem if available

**filetype** - keyword, text.text

* *xprotect_entries.filetype* - Use this file type to match

**filevault_status** - keyword, text.text

* *disk_encryption.filevault_status* - FileVault status with one of following values: on | off | unknown

**filter** - keyword, text.text

* *wmi_filter_consumer_binding.filter* - Reference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.

**filter_name** - keyword, text.text

* *iptables.filter_name* - Packet matching filter table name.

**fingerprint** - keyword, text.text

* *lxd_certificates.fingerprint* - SHA256 hash of the certificate

**finished_at** - keyword, text.text

* *docker_containers.finished_at* - Container finish time as string

**firewall** - keyword, text.text

* *windows_security_center.firewall* - The health of the monitored Firewall (see windows_security_products)

**firewall_unload** - keyword, number.long

* *alf.firewall_unload* - 1 If firewall unloading enabled else 0

**firmware_type** - keyword, text.text

* *platform_info.firmware_type* - The type of firmware (uefi, bios, iboot, openfirmware, unknown).

**firmware_version** - keyword, text.text

* *ibridge_info.firmware_version* - The build version of the firmware

**fix_comments** - keyword, text.text

* *patches.fix_comments* - Additional comments about the patch.

**flag** - keyword, number.long

* *shadow.flag* - Reserved

**flags** - keyword

* *device_partitions.flags* - Value that describes the partition (TSK_VS_PART_FLAG_ENUM)
* *dns_cache.flags* - DNS record flags
* *interface_details.flags* - Flags (netdevice) for the device
* *kernel_keys.flags* - A set of flags describing the state of the key.
* *mounts.flags* - Mounted device flags
* *pipes.flags* - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes
* *process_etw_events.flags* - Process Flags
* *routes.flags* - Flags to describe route

**folder_id** - keyword, text.text

* *ycloud_instance_metadata.folder_id* - Folder identifier for the VM

**following** - keyword, text.text

* *systemd_units.following* - The name of another unit that this unit follows in state

**force_logoff_when_expire** - keyword, number.long

* *security_profile_info.force_logoff_when_expire* - Determines whether SMB client sessions with the SMB server will be forcibly disconnected when the client’s logon hours expire

**forced** - keyword, number.long

* *preferences.forced* - 1 if the value is forced/managed, else 0

**form_factor** - keyword, text.text

* *memory_devices.form_factor* - Implementation form factor for this memory device

**format** - keyword, text.text

* *cups_jobs.format* - The format of the print job

**forwarding_enabled** - keyword, number.long

* *interface_ipv6.forwarding_enabled* - Enable IP forwarding

**fragment_path** - keyword, text.text

* *systemd_units.fragment_path* - The unit file path this unit was read from, if there is any

**frame_backtrace** - keyword, text.text

* *kernel_panics.frame_backtrace* - Backtrace of the crashed module

**free** - keyword, number.long

* *virtual_memory_info.free* - Total number of free pages.

**free_space** - keyword, number.long

* *logical_drives.free_space* - The amount of free space, in bytes, of the drive (-1 on failure).

**friendly_name** - keyword, text.text

* *interface_addresses.friendly_name* - The friendly display name of the interface.
* *interface_details.friendly_name* - The friendly display name of the interface.

**from_webstore** - keyword, text.text

* *chrome_extensions.from_webstore* - True if this extension was installed from the web store

**fs_id** - keyword, text.text

* *quicklook_cache.fs_id* - Quicklook file fs_id key

**fsgid** - keyword

* *process_events.fsgid* - Filesystem group ID at process start
* *process_file_events.fsgid* - Filesystem group ID of the process using the file

**fsuid** - keyword

* *apparmor_events.fsuid* - Filesystem user ID
* *process_events.fsuid* - Filesystem user ID at process start
* *process_file_events.fsuid* - Filesystem user ID of the process using the file

**gateway** - keyword, text.text

* *docker_container_networks.gateway* - Gateway
* *docker_networks.gateway* - Network gateway
* *routes.gateway* - Route gateway

**gid** - keyword

* *asl.gid* - GID that sent the log message (set by the server).
* *bpf_process_events.gid* - Group ID
* *bpf_socket_events.gid* - Group ID
* *device_file.gid* - Owning group ID
* *docker_container_processes.gid* - Group ID
* *es_process_events.gid* - Group ID of the process
* *file.gid* - Owning group ID
* *file_events.gid* - Owning group ID
* *groups.gid* - Unsigned int64 group ID
* *kernel_keys.gid* - The group ID of the key.
* *package_bom.gid* - Expected group of file or directory
* *process_events.gid* - Group ID at process start
* *process_file_events.gid* - The gid of the process performing the action
* *processes.gid* - Unsigned group ID
* *seccomp_events.gid* - Group ID of the user who started the analyzed process
* *user_groups.gid* - Group ID
* *users.gid* - Group ID (unsigned)

**gid_signed** - keyword, number.long

* *groups.gid_signed* - A signed int64 version of gid
* *users.gid_signed* - Default group ID as int64 signed (Apple)

**git_commit** - keyword, text.text

* *docker_version.git_commit* - Docker build git commit

**global_seq_num** - keyword, number.long

* *es_process_events.global_seq_num* - Global sequence number
* *es_process_file_events.global_seq_num* - Global sequence number

**global_state** - keyword, number.long

* *alf.global_state* - 1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0

**go_version** - keyword, text.text

* *docker_version.go_version* - Go version

**gpgcheck** - keyword, text.text

* *yum_sources.gpgcheck* - Whether packages are GPG checked

**gpgkey** - keyword, text.text

* *yum_sources.gpgkey* - URL to GPG key

**grace_period** - keyword, number.long

* *screenlock.grace_period* - The amount of time in seconds the screen must be asleep or the screensaver on before a password is required on-wake. 0 = immediately; -1 = no password is required on-wake

**group_sid** - keyword, text.text

* *groups.group_sid* - Unique group ID

**grouping** - keyword, text.text

* *windows_firewall_rules.grouping* - Group to which an individual rule belongs

**groupname** - keyword, text.text

* *groups.groupname* - Canonical local group name
* *launchd.groupname* - Run this daemon or agent as this group
* *rpm_package_files.groupname* - File default groupname from info DB
* *suid_bin.groupname* - Binary owner group

**guest** - keyword, number.long

* *cpu_time.guest* - Time spent running a virtual CPU for a guest OS under the control of the Linux kernel

**guest_nice** - keyword, number.long

* *cpu_time.guest_nice* - Time spent running a niced guest

**handle** - keyword, text.text

* *memory_array_mapped_addresses.handle* - Handle, or instance number, associated with the structure
* *memory_arrays.handle* - Handle, or instance number, associated with the array
* *memory_device_mapped_addresses.handle* - Handle, or instance number, associated with the structure
* *memory_devices.handle* - Handle, or instance number, associated with the structure in SMBIOS
* *memory_error_info.handle* - Handle, or instance number, associated with the structure
* *oem_strings.handle* - Handle, or instance number, associated with the Type 11 structure
* *smbios_tables.handle* - Table entry handle

**handle_count** - keyword, number.long

* *processes.handle_count* - Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process.

**handler** - keyword, text.text

* *app_schemes.handler* - Application label for the handler

**hard_limit** - keyword, text.text

* *ulimit_info.hard_limit* - Maximum limit value

**hard_links** - keyword, number.long

* *device_file.hard_links* - Number of hard links
* *file.hard_links* - Number of hard links

**hardware_model** - keyword, text.text

* *disk_info.hardware_model* - Hard drive model.
* *system_info.hardware_model* - Hardware model

**hardware_serial** - keyword, text.text

* *system_info.hardware_serial* - Device serial number

**hardware_vendor** - keyword, text.text

* *system_info.hardware_vendor* - Hardware vendor

**hardware_version** - keyword, text.text

* *system_info.hardware_version* - Hardware version

**has_expired** - keyword, number.long

* *curl_certificate.has_expired* - 1 if the certificate has expired, 0 otherwise

**hash** - keyword, text.text

* *prefetch.hash* - Prefetch CRC hash.

**hash_alg** - keyword, text.text

* *shadow.hash_alg* - Password hashing algorithm

**hash_resources** - keyword, number.long

* *signature.hash_resources* - Set to 1 to also hash resources, or 0 otherwise. Default is 1

**hashed** - keyword, number.long

* *file_events.hashed* - 1 if the file was hashed, 0 if not, -1 if hashing failed

**header** - keyword, text.text

* *sudoers.header* - Symbol for given rule

**header_pid** - keyword, number.long

* *process_etw_events.header_pid* - Process ID of the process reporting the event

**header_size** - keyword, number.long

* *smbios_tables.header_size* - Header size in bytes

**health** - keyword, text.text

* *battery.health* - One of the following: "Good" describes a well-performing battery, "Fair" describes a functional battery with limited capacity, or "Poor" describes a battery that’s not capable of providing power

**hidden** - keyword, number.long

* *scheduled_tasks.hidden* - Whether or not the task is visible in the UI
* *smc_keys.hidden* - 1 if this key is normally hidden, otherwise 0

**history_file** - keyword, text.text

* *shell_history.history_file* - Path to the .*_history for this user

**hit_count** - keyword, text.text

* *quicklook_cache.hit_count* - Number of cache hits on thumbnail

**home_directory** - keyword, text.text

* *logon_sessions.home_directory* - The home directory for the logon session.

**home_directory_drive** - keyword, text.text

* *logon_sessions.home_directory_drive* - The drive location of the home directory of the logon session.

**homepage** - keyword, text.text

* *npm_packages.homepage* - Package supplied homepage

**hop_limit** - keyword, number.long

* *interface_ipv6.hop_limit* - Current Hop Limit

**hopcount** - keyword, number.long

* *routes.hopcount* - Max hops expected

**host** - keyword, text.text

* *asl.host* - Sender’s address (set by the server).
* *last.host* - Entry hostname
* *logged_in_users.host* - Remote hostname
* *preferences.host* - *current* or *any* host, where *current* takes precedence
* *syslog_events.host* - Hostname configured for syslog

**host_ip** - keyword, text.text

* *docker_container_ports.host_ip* - Host IP address on which public port is listening

**host_port** - keyword, number.long

* *docker_container_ports.host_port* - Host port

**hostname** - keyword, text.text

* *curl_certificate.hostname* - Hostname to CURL (domain[:port], e.g. osquery.io)
* *system_info.hostname* - Network hostname including domain
* *ycloud_instance_metadata.hostname* - Hostname of the VM

**hostnames** - keyword, text.text

* *etc_hosts.hostnames* - Raw hosts mapping

**hotfix_id** - keyword, text.text

* *patches.hotfix_id* - The KB ID of the patch.

**hour** - keyword, text.text

* *crontab.hour* - The hour of the day for the job
* *time.hour* - Current hour in UTC

**hours** - keyword, number.long

* *uptime.hours* - Hours of uptime

**hresult** - keyword, number.long

* *windows_update_history.hresult* - HRESULT value that is returned from the operation on an update

**http_proxy** - keyword, text.text

* *docker_info.http_proxy* - HTTP proxy

**https_proxy** - keyword, text.text

* *docker_info.https_proxy* - HTTPS proxy

**hwaddr** - keyword, text.text

* *lxd_networks.hwaddr* - Hardware address for this network

**iam_arn** - keyword, text.text

* *ec2_instance_metadata.iam_arn* - If there is an IAM role associated with the instance, contains instance profile ARN

**ibrs_support_enabled** - keyword, number.long

* *kva_speculative_info.ibrs_support_enabled* - Windows uses IBRS.

**ibytes** - keyword, number.long

* *interface_details.ibytes* - Input bytes

**icmp_types_codes** - keyword, text.text

* *windows_firewall_rules.icmp_types_codes* - ICMP types and codes for the rule

**icon_mode** - keyword, number.long

* *quicklook_cache.icon_mode* - Thumbnail icon mode

**id** - keyword, text.text

* *disk_info.id* - The unique identifier of the drive on the system.
* *dns_resolvers.id* - Address type index or order
* *docker_container_envs.id* - Container ID
* *docker_container_fs_changes.id* - Container ID
* *docker_container_labels.id* - Container ID
* *docker_container_mounts.id* - Container ID
* *docker_container_networks.id* - Container ID
* *docker_container_ports.id* - Container ID
* *docker_container_processes.id* - Container ID
* *docker_container_stats.id* - Container ID
* *docker_containers.id* - Container ID
* *docker_image_history.id* - Image ID
* *docker_image_labels.id* - Image ID
* *docker_image_layers.id* - Image ID
* *docker_images.id* - Image ID
* *docker_info.id* - Docker system ID
* *docker_network_labels.id* - Network ID
* *docker_networks.id* - Network ID
* *iokit_devicetree.id* - IOKit internal registry ID
* *iokit_registry.id* - IOKit internal registry ID
* *lxd_images.id* - Image ID
* *systemd_units.id* - Unique unit identifier

**identifier** - keyword, text.text

* *browser_plugins.identifier* - Plugin identifier
* *chrome_extension_content_scripts.identifier* - Extension identifier
* *chrome_extensions.identifier* - Extension identifier, computed from its manifest. Empty in case of error.
* *crashes.identifier* - Identifier of the crashed process
* *firefox_addons.identifier* - Addon identifier
* *safari_extensions.identifier* - Extension identifier
* *signature.identifier* - The signing identifier sealed into the signature
* *system_extensions.identifier* - Identifier name
* *xprotect_meta.identifier* - Browser plugin or extension identifier

**identifying_number** - keyword, text.text

* *programs.identifying_number* - Product identification such as a serial number on software, or a die number on a hardware chip.

**identity** - keyword, text.text

* *xprotect_entries.identity* - XProtect identity (SHA1) of content

**idle** - keyword, number.long

* *cpu_time.idle* - Time spent in the idle task

**idrops** - keyword, number.long

* *interface_details.idrops* - Input drops

**idx** - keyword, number.long

* *kernel_extensions.idx* - Extension load tag or index

**ierrors** - keyword, number.long

* *interface_details.ierrors* - Input errors

**image** - keyword, text.text

* *docker_containers.image* - Docker image (name) used to launch this container
* *drivers.image* - Path to driver image file

**image_id** - keyword, text.text

* *docker_containers.image_id* - Docker image ID

**images** - keyword, number.long

* *docker_info.images* - Number of images

**inactive** - keyword, number.long

* *memory_info.inactive* - The total amount of buffer or page cache memory, in bytes, that are free and available
* *shadow.inactive* - Number of days after password expires until account is blocked
* *virtual_memory_info.inactive* - Total number of inactive pages.

**include_remote** - keyword, number.long

* *users.include_remote* - 1 to include remote (LDAP/AD) accounts (default 0). Warning: without any uid/username filtering it may list whole LDAP directories

**inetd_compatibility** - keyword, text.text

* *launchd.inetd_compatibility* - Run this daemon or agent as it was launched from inetd

**inf** - keyword, text.text

* *drivers.inf* - Associated inf file

**info** - keyword, text.text

* *apparmor_events.info* - Additional information

**info_access** - keyword, text.text

* *curl_certificate.info_access* - Authority Information Access

**info_string** - keyword, text.text

* *apps.info_string* - Info properties CFBundleGetInfoString label

**inherited_from** - keyword, text.text

* *ntfs_acl_permissions.inherited_from* - The inheritance policy of the ACE.

**iniface** - keyword, text.text

* *iptables.iniface* - Input interface for the rule.

**iniface_mask** - keyword, text.text

* *iptables.iniface_mask* - Input interface mask for the rule.

**inode** - keyword, number.long

* *device_file.inode* - Filesystem inode number
* *device_hash.inode* - Filesystem inode number
* *file.inode* - Filesystem inode number
* *file_events.inode* - Filesystem inode number
* *process_memory_map.inode* - Mapped path inode, 0 means uninitialized (BSS)
* *process_open_pipes.inode* - Pipe inode number
* *quicklook_cache.inode* - Parsed file ID (inode) from fs_id

**inodes** - keyword, number.long

* *device_partitions.inodes* - Number of meta nodes
* *mounts.inodes* - Mounted device used inodes

**inodes_free** - keyword, number.long

* *mounts.inodes_free* - Mounted device free inodes

**inodes_total** - keyword, number.long

* *lxd_storage_pools.inodes_total* - Total number of inodes available in this storage pool

**inodes_used** - keyword, number.long

* *lxd_storage_pools.inodes_used* - Number of inodes used

**input_eax** - keyword, text.text

* *cpuid.input_eax* - Value of EAX used

**install_date** - keyword

* *os_version.install_date* - The install date of the OS.
* *patches.install_date* - Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.
* *programs.install_date* - Date that this product was installed on the system.
* *shared_resources.install_date* - Indicates when the object was installed. Lack of a value does not indicate that the object is not installed.

**install_location** - keyword, text.text

* *programs.install_location* - The installation location directory of the product.

**install_source** - keyword, text.text

* *programs.install_source* - The installation source of the product.

**install_time** - keyword

* *appcompat_shims.install_time* - Install time of the SDB
* *chrome_extensions.install_time* - Extension install time, in its original Webkit format
* *package_receipts.install_time* - Timestamp of install time
* *rpm_packages.install_time* - When the package was installed

**install_timestamp** - keyword, number.long

* *chrome_extensions.install_timestamp* - Extension install time, converted to unix time

**installed_at** - keyword, number.long

* *vscode_extensions.installed_at* - Installed Timestamp

**installed_by** - keyword, text.text

* *patches.installed_by* - The system context in which the patch as installed.

**installed_on** - keyword, text.text

* *patches.installed_on* - The date when the patch was installed.

**installer_name** - keyword, text.text

* *package_receipts.installer_name* - Name of installer process

**instance_id** - keyword, text.text

* *ec2_instance_metadata.instance_id* - EC2 instance ID
* *ec2_instance_tags.instance_id* - EC2 instance ID
* *osquery_info.instance_id* - Unique, long-lived ID per instance of osquery
* *ycloud_instance_metadata.instance_id* - Unique identifier for the VM

**instance_identifier** - keyword, text.text

* *hvci_status.instance_identifier* - The instance ID of Device Guard.

**instance_type** - keyword, text.text

* *ec2_instance_metadata.instance_type* - EC2 instance type

**instances** - keyword, number.long

* *pipes.instances* - Number of instances of the named pipe

**interface** - keyword, text.text

* *arp_cache.interface* - Interface of the network for the MAC
* *interface_addresses.interface* - Interface name
* *interface_details.interface* - Interface name
* *interface_ipv6.interface* - Interface name
* *routes.interface* - Route local interface
* *wifi_status.interface* - Name of the interface
* *wifi_survey.interface* - Name of the interface

**interleave_data_depth** - keyword, number.long

* *memory_device_mapped_addresses.interleave_data_depth* - The max number of consecutive rows from memory device that are accessed in a single interleave transfer; 0 indicates device is non-interleave

**interleave_position** - keyword, number.long

* *memory_device_mapped_addresses.interleave_position* - The position of the device in a interleave, i.e. 0 indicates non-interleave, 1 indicates 1st interleave, 2 indicates 2nd interleave, etc.

**internal** - keyword, number.long

* *osquery_registry.internal* - 1 If the plugin is internal else 0

**internet_settings** - keyword, text.text

* *windows_security_center.internet_settings* - The health of the Internet Settings

**internet_sharing** - keyword, number.long

* *sharing_preferences.internet_sharing* - 1 If internet sharing is enabled else 0

**interval** - keyword, number.long

* *docker_container_stats.interval* - Difference between read and preread in nano-seconds
* *osquery_schedule.interval* - The interval in seconds to run this query, not an exact interval

**iowait** - keyword, number.long

* *cpu_time.iowait* - Time spent waiting for I/O to complete

**ip** - keyword, text.text

* *seccomp_events.ip* - Instruction pointer value

**ip_address** - keyword, text.text

* *docker_container_networks.ip_address* - IP address

**ip_prefix_len** - keyword, number.long

* *docker_container_networks.ip_prefix_len* - IP subnet prefix length

**ipackets** - keyword, number.long

* *interface_details.ipackets* - Input packets

**ipc_namespace** - keyword, text.text

* *docker_containers.ipc_namespace* - IPC namespace
* *process_namespaces.ipc_namespace* - ipc namespace inode

**ipv4_address** - keyword, text.text

* *lxd_networks.ipv4_address* - IPv4 address

**ipv4_forwarding** - keyword, number.long

* *docker_info.ipv4_forwarding* - 1 if IPv4 forwarding is enabled. 0 otherwise

**ipv4_internet** - keyword, number.long

* *connectivity.ipv4_internet* - True if any interface is connected to the Internet via IPv4

**ipv4_local_network** - keyword, number.long

* *connectivity.ipv4_local_network* - True if any interface is connected to a routed network via IPv4

**ipv4_no_traffic** - keyword, number.long

* *connectivity.ipv4_no_traffic* - True if any interface is connected via IPv4, but has seen no traffic

**ipv4_subnet** - keyword, number.long

* *connectivity.ipv4_subnet* - True if any interface is connected to the local subnet via IPv4

**ipv6_address** - keyword, text.text

* *docker_container_networks.ipv6_address* - IPv6 address
* *lxd_networks.ipv6_address* - IPv6 address

**ipv6_gateway** - keyword, text.text

* *docker_container_networks.ipv6_gateway* - IPv6 gateway

**ipv6_internet** - keyword, number.long

* *connectivity.ipv6_internet* - True if any interface is connected to the Internet via IPv6

**ipv6_local_network** - keyword, number.long

* *connectivity.ipv6_local_network* - True if any interface is connected to a routed network via IPv6

**ipv6_no_traffic** - keyword, number.long

* *connectivity.ipv6_no_traffic* - True if any interface is connected via IPv6, but has seen no traffic

**ipv6_prefix_len** - keyword, number.long

* *docker_container_networks.ipv6_prefix_len* - IPv6 subnet prefix length

**ipv6_subnet** - keyword, number.long

* *connectivity.ipv6_subnet* - True if any interface is connected to the local subnet via IPv6

**irq** - keyword, number.long

* *cpu_time.irq* - Time spent servicing interrupts

**is_active** - keyword, number.long

* *running_apps.is_active* - (DEPRECATED)

**is_hidden** - keyword, number.long

* *groups.is_hidden* - IsHidden attribute set in OpenDirectory
* *users.is_hidden* - IsHidden attribute set in OpenDirectory

**iso_8601** - keyword, text.text

* *time.iso_8601* - Current time (ISO format) in UTC

**issuer** - keyword, text.text

* *certificates.issuer* - Certificate issuer distinguished name (deprecated, use issuer2)

**issuer2** - keyword, text.text

* *certificates.issuer2* - Certificate issuer distinguished name

**issuer_alternative_names** - keyword, text.text

* *curl_certificate.issuer_alternative_names* - Issuer Alternative Name

**issuer_common_name** - keyword, text.text

* *curl_certificate.issuer_common_name* - Issuer common name

**issuer_name** - keyword, text.text

* *authenticode.issuer_name* - The certificate issuer name

**issuer_organization** - keyword, text.text

* *curl_certificate.issuer_organization* - Issuer organization

**issuer_organization_unit** - keyword, text.text

* *curl_certificate.issuer_organization_unit* - Issuer organization unit

**job_id** - keyword, number.long

* *systemd_units.job_id* - Next queued job id

**job_path** - keyword, text.text

* *systemd_units.job_path* - The object path for the job

**job_type** - keyword, text.text

* *systemd_units.job_type* - Job type

**json_cmdline** - keyword, text.text

* *bpf_process_events.json_cmdline* - Command line arguments, in JSON format

**keep_alive** - keyword, text.text

* *launchd.keep_alive* - Should the process be restarted if killed

**kernel_extensions** - keyword, number.long

* *secureboot.kernel_extensions* - (Apple Silicon) Allow user management of kernel extensions from identified developers (1 if allowed)

**kernel_memory** - keyword, number.long

* *docker_info.kernel_memory* - 1 if kernel memory limit support is enabled. 0 otherwise

**kernel_version** - keyword, text.text

* *docker_info.kernel_version* - Kernel version
* *docker_version.kernel_version* - Kernel version
* *kernel_panics.kernel_version* - Version of the system kernel

**key** - keyword, text.text

* *authorized_keys.key* - Key encoded as base64
* *azure_instance_tags.key* - The tag key
* *chrome_extensions.key* - The extension key, from the manifest file
* *docker_container_envs.key* - Environment variable name
* *docker_container_labels.key* - Label key
* *docker_image_labels.key* - Label key
* *docker_network_labels.key* - Label key
* *docker_volume_labels.key* - Label key
* *ec2_instance_tags.key* - Tag key
* *extended_attributes.key* - Name of the value generated from the extended attribute
* *known_hosts.key* - parsed authorized keys line
* *launchd_overrides.key* - Name of the override key
* *lxd_instance_config.key* - Configuration parameter name
* *lxd_instance_devices.key* - Device info param name
* *mdls.key* - Name of the metadata key
* *plist.key* - Preference top-level key
* *power_sensors.key* - The SMC key on macOS
* *preferences.key* - Preference top-level key
* *process_envs.key* - Environment variable name
* *registry.key* - Name of the key to search for
* *selinux_settings.key* - Key or class name.
* *smc_keys.key* - 4-character key
* *temperature_sensors.key* - The SMC key on macOS

**key_algorithm** - keyword, text.text

* *certificates.key_algorithm* - Key algorithm used

**key_file** - keyword, text.text

* *authorized_keys.key_file* - Path to the authorized_keys file
* *known_hosts.key_file* - Path to known_hosts file

**key_group_name** - keyword, text.text

* *user_ssh_keys.key_group_name* - The group of the private key. Supported for a subset of key_types implemented by OpenSSL

**key_length** - keyword, number.long

* *user_ssh_keys.key_length* - The cryptographic length of the cryptosystem to which the private key belongs, in bits. Definition of cryptographic length is specific to cryptosystem. -1 if unavailable

**key_security_bits** - keyword, number.long

* *user_ssh_keys.key_security_bits* - The number of security bits of the private key, bits of security as defined in NIST SP800-57. -1 if unavailable

**key_strength** - keyword, text.text

* *certificates.key_strength* - Key size used for RSA/DSA, or curve name

**key_type** - keyword, text.text

* *user_ssh_keys.key_type* - The type of the private key. One of [rsa, dsa, dh, ec, hmac, cmac], or the empty string.

**key_usage** - keyword, text.text

* *certificates.key_usage* - Certificate key usage and extended key usage
* *curl_certificate.key_usage* - Usage of key in certificate

**keychain_path** - keyword, text.text

* *keychain_acls.keychain_path* - The path of the keychain

**keyword** - keyword, text.text

* *portage_keywords.keyword* - The keyword applied to the package

**keywords** - keyword, text.text

* *windows_eventlog.keywords* - A bitmask of the keywords defined in the event
* *windows_events.keywords* - A bitmask of the keywords defined in the event

**kva_shadow_enabled** - keyword, number.long

* *kva_speculative_info.kva_shadow_enabled* - Kernel Virtual Address shadowing is enabled.

**kva_shadow_inv_pcid** - keyword, number.long

* *kva_speculative_info.kva_shadow_inv_pcid* - Kernel VA INVPCID is enabled.

**kva_shadow_pcid** - keyword, number.long

* *kva_speculative_info.kva_shadow_pcid* - Kernel VA PCID flushing optimization is enabled.

**kva_shadow_user_global** - keyword, number.long

* *kva_speculative_info.kva_shadow_user_global* - User pages are marked as global.

**label** - keyword, text.text

* *apparmor_events.label* - AppArmor label
* *augeas.label* - The label of the configuration item
* *authorization_mechanisms.label* - Label of the authorization right
* *authorizations.label* - Item name, usually in reverse domain format
* *block_devices.label* - Block device label string
* *device_partitions.label* - The partition name as stored in the partition table
* *keychain_acls.label* - An optional label tag that may be included with the keychain entry
* *keychain_items.label* - Generic item name
* *launchd.label* - Daemon or agent service name
* *launchd_overrides.label* - Daemon or agent service name
* *quicklook_cache.label* - Parsed version *gen* field
* *sandboxes.label* - UTI-format bundle or label ID

**language** - keyword, text.text

* *programs.language* - The language of the product.

**last_change** - keyword, number.long

* *interface_details.last_change* - Time of last device modification (optional)
* *shadow.last_change* - Date of last password change (starting from UNIX epoch date)

**last_connected** - keyword, number.long

* *wifi_networks.last_connected* - Last time this network was connected to as a unix_time

**last_executed** - keyword, number.long

* *osquery_schedule.last_executed* - UNIX time stamp in seconds of the last completed execution

**last_execution_time** - keyword, number.long

* *background_activities_moderator.last_execution_time* - Most recent time application was executed.
* *userassist.last_execution_time* - Most recent time application was executed.

**last_hit_date** - keyword, number.long

* *quicklook_cache.last_hit_date* - Apple date format for last thumbnail cache hit

**last_loaded** - keyword, text.text

* *kernel_panics.last_loaded* - Last loaded module before panic

**last_memory** - keyword, number.long

* *osquery_schedule.last_memory* - Resident memory in bytes left allocated after collecting results of the latest execution

**last_opened_time** - keyword

* *apps.last_opened_time* - The time that the app was last used
* *office_mru.last_opened_time* - Most recent opened time file was opened

**last_run_code** - keyword, text.text

* *scheduled_tasks.last_run_code* - Exit status code of the last task run

**last_run_message** - keyword, text.text

* *scheduled_tasks.last_run_message* - Exit status message of the last task run

**last_run_time** - keyword, number.long

* *prefetch.last_run_time* - Most recent time application was run.
* *scheduled_tasks.last_run_time* - Timestamp the task last ran

**last_system_time** - keyword, number.long

* *osquery_schedule.last_system_time* - System time in milliseconds of the latest execution

**last_unloaded** - keyword, text.text

* *kernel_panics.last_unloaded* - Last unloaded module before panic

**last_used_at** - keyword, text.text

* *lxd_images.last_used_at* - ISO time for the most recent use of this image in terms of container spawn

**last_user_time** - keyword, number.long

* *osquery_schedule.last_user_time* - User time in milliseconds of the latest execution

**last_wall_time_ms** - keyword, number.long

* *osquery_schedule.last_wall_time_ms* - Wall time in milliseconds of the latest execution

**launch_type** - keyword, text.text

* *xprotect_entries.launch_type* - Launch services content type

**layer_id** - keyword, text.text

* *docker_image_layers.layer_id* - Layer ID

**layer_order** - keyword, number.long

* *docker_image_layers.layer_order* - Layer Order (1 = base layer)

**level** - keyword

* *asl.level* - Log level number.  See levels in asl.h.
* *unified_log.level* - the severity level of the entry
* *windows_eventlog.level* - Severity level associated with the event
* *windows_events.level* - The severity level associated with the event

**license** - keyword, text.text

* *chocolatey_packages.license* - License under which package is launched
* *npm_packages.license* - License under which package is launched
* *python_packages.license* - License under which package is launched

**link_speed** - keyword, number.long

* *interface_details.link_speed* - Interface speed in Mb/s

**linked_against** - keyword, text.text

* *kernel_extensions.linked_against* - Indexes of extensions this extension is linked against

**load_percentage** - keyword, number.long

* *cpu_info.load_percentage* - The current percentage of utilization of the CPU.

**load_state** - keyword, text.text

* *systemd_units.load_state* - Reflects whether the unit definition was properly loaded

**local_address** - keyword, text.text

* *bpf_socket_events.local_address* - Local address associated with socket
* *process_open_sockets.local_address* - Socket local address
* *socket_events.local_address* - Local address associated with socket

**local_addresses** - keyword, text.text

* *windows_firewall_rules.local_addresses* - Local addresses for the rule

**local_hostname** - keyword, text.text

* *ec2_instance_metadata.local_hostname* - Private IPv4 DNS hostname of the first interface of this instance
* *system_info.local_hostname* - Local hostname (optional)

**local_ipv4** - keyword, text.text

* *ec2_instance_metadata.local_ipv4* - Private IPv4 address of the first interface of this instance

**local_port** - keyword, number.long

* *bpf_socket_events.local_port* - Local network protocol port number
* *process_open_sockets.local_port* - Socket local port
* *socket_events.local_port* - Local network protocol port number

**local_ports** - keyword, text.text

* *windows_firewall_rules.local_ports* - Local ports for the rule

**local_timezone** - keyword, text.text

* *time.local_timezone* - Current local timezone in of the system

**location** - keyword, text.text

* *azure_instance_metadata.location* - Azure Region the VM is running in
* *firefox_addons.location* - Global, profile location
* *memory_arrays.location* - Physical location of the memory array
* *package_receipts.location* - Optional relative install path on volume

**lock** - keyword, text.text

* *chassis_info.lock* - If TRUE, the frame is equipped with a lock.

**lock_status** - keyword, number.long

* *bitlocker_info.lock_status* - The accessibility status of the drive from Windows.

**locked** - keyword, number.long

* *shared_memory.locked* - 1 if segment is locked else 0

**lockout_bad_count** - keyword, number.long

* *security_profile_info.lockout_bad_count* - Number of failed logon attempts after which a user account MUST be locked out

**log_file_disk_quota_mb** - keyword, number.long

* *carbon_black_info.log_file_disk_quota_mb* - Event file disk quota in MB

**log_file_disk_quota_percentage** - keyword, number.long

* *carbon_black_info.log_file_disk_quota_percentage* - Event file disk quota in a percentage

**logging_driver** - keyword, text.text

* *docker_info.logging_driver* - Logging driver

**logging_enabled** - keyword, number.long

* *alf.logging_enabled* - 1 If logging mode is enabled else 0

**logging_option** - keyword, number.long

* *alf.logging_option* - Firewall logging option

**logical_processors** - keyword, number.long

* *cpu_info.logical_processors* - The number of logical processors of the CPU.

**logon_domain** - keyword, text.text

* *logon_sessions.logon_domain* - The name of the domain used to authenticate the owner of the logon session.

**logon_id** - keyword, number.long

* *logon_sessions.logon_id* - A locally unique identifier (LUID) that identifies a logon session.

**logon_script** - keyword, text.text

* *logon_sessions.logon_script* - The script used for logging on.

**logon_server** - keyword, text.text

* *logon_sessions.logon_server* - The name of the server used to authenticate the owner of the logon session.

**logon_sid** - keyword, text.text

* *logon_sessions.logon_sid* - The user’s security identifier (SID).

**logon_time** - keyword, number.long

* *logon_sessions.logon_time* - The time the session owner logged on.

**logon_to_change_password** - keyword, number.long

* *security_profile_info.logon_to_change_password* - Determines if logon session is required to change the password

**logon_type** - keyword, text.text

* *logon_sessions.logon_type* - The logon method.

**lsa_anonymous_name_lookup** - keyword, number.long

* *security_profile_info.lsa_anonymous_name_lookup* - Determines if an anonymous user is allowed to query the local LSA policy

**mac** - keyword, text.text

* *arp_cache.mac* - MAC address of broadcasted address
* *ec2_instance_metadata.mac* - MAC address for the first network interface of this EC2 instance
* *interface_details.mac* - MAC of interface (optional)

**mac_address** - keyword, text.text

* *docker_container_networks.mac_address* - MAC address

**machine_name** - keyword, text.text

* *windows_crashes.machine_name* - Name of the machine where the crash happened

**magic_db_files** - keyword, text.text

* *magic.magic_db_files* - Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc

**main** - keyword, number.long

* *connected_displays.main* - If the display is the main display.

**maintainer** - keyword, text.text

* *apt_sources.maintainer* - Repository maintainer
* *deb_packages.maintainer* - Package maintainer

**major** - keyword, number.long

* *os_version.major* - Major release version

**major_version** - keyword, number.long

* *windows_crashes.major_version* - Windows major version of the machine

**managed** - keyword, number.long

* *lxd_networks.managed* - 1 if network created by LXD, 0 otherwise

**mandatory_label** - keyword, text.text

* *process_etw_events.mandatory_label* - Primary token mandatory label sid - Present only on ProcessStart events

**manifest_hash** - keyword, text.text

* *chrome_extensions.manifest_hash* - The SHA256 hash of the manifest.json file

**manifest_json** - keyword, text.text

* *chrome_extensions.manifest_json* - The manifest file of the extension

**manual** - keyword, number.long

* *managed_policies.manual* - 1 if policy was loaded manually, otherwise 0

**manufacture_date** - keyword, number.long

* *battery.manufacture_date* - The date the battery was manufactured UNIX Epoch

**manufactured_week** - keyword, number.long

* *connected_displays.manufactured_week* - The manufacture week of the display. This field is 0 if not supported

**manufactured_year** - keyword, number.long

* *connected_displays.manufactured_year* - The manufacture year of the display. This field is 0 if not supported

**manufacturer** - keyword, text.text

* *battery.manufacturer* - The battery manufacturer’s name
* *chassis_info.manufacturer* - The manufacturer of the chassis.
* *cpu_info.manufacturer* - The manufacturer of the CPU.
* *disk_info.manufacturer* - The manufacturer of the disk.
* *drivers.manufacturer* - Device manufacturer
* *interface_details.manufacturer* - Name of the network adapter’s manufacturer.
* *memory_devices.manufacturer* - Manufacturer ID string
* *video_info.manufacturer* - The manufacturer of the gpu.

**manufacturer_id** - keyword, number.long

* *tpm_info.manufacturer_id* - TPM manufacturers ID

**manufacturer_name** - keyword, text.text

* *tpm_info.manufacturer_name* - TPM manufacturers name

**manufacturer_version** - keyword, text.text

* *tpm_info.manufacturer_version* - TPM version

**mask** - keyword, text.text

* *interface_addresses.mask* - Interface netmask
* *portage_keywords.mask* - If the package is masked

**match** - keyword, text.text

* *chrome_extension_content_scripts.match* - The pattern that the script is matched against
* *iptables.match* - Matching rule that applies.

**matches** - keyword, text.text

* *yara.matches* - List of YARA matches
* *yara_events.matches* - List of YARA matches

**max** - keyword, number.long

* *fan_speed_sensors.max* - Maximum speed
* *shadow.max* - Maximum number of days between password changes

**max_capacity** - keyword, number.long

* *battery.max_capacity* - The battery’s actual capacity when it is fully charged in mAh
* *memory_arrays.max_capacity* - Maximum capacity of array in gigabytes

**max_clock_speed** - keyword, number.long

* *cpu_info.max_clock_speed* - The maximum possible frequency of the CPU.

**max_instances** - keyword, number.long

* *pipes.max_instances* - The maximum number of instances creatable for this pipe

**max_results** - keyword, number.long

* *windows_search.max_results* - Maximum number of results returned by windows api, set to -1 for unlimited

**max_rows** - keyword, number.long

* *unified_log.max_rows* - the max number of rows returned (defaults to 100)

**max_speed** - keyword, number.long

* *memory_devices.max_speed* - Max speed of memory device in megatransfers per second (MT/s)

**max_voltage** - keyword, number.long

* *memory_devices.max_voltage* - Maximum operating voltage of device in millivolts

**maximum_allowed** - keyword, number.long

* *shared_resources.maximum_allowed* - Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.

**maximum_password_age** - keyword, number.long

* *security_profile_info.maximum_password_age* - Determines the maximum number of days that a password can be used before the client requires the user to change it

**md5** - keyword, text.text

* *acpi_tables.md5* - MD5 hash of table content
* *device_hash.md5* - MD5 hash of provided inode data
* *file_events.md5* - The MD5 of the file after change
* *hash.md5* - MD5 hash of provided filesystem data
* *smbios_tables.md5* - MD5 hash of table entry

**md_device_name** - keyword, text.text

* *md_drives.md_device_name* - md device name

**mdm_managed** - keyword, number.long

* *system_extensions.mdm_managed* - 1 if managed by MDM system extension payload configuration, 0 otherwise

**mdm_operations** - keyword, number.long

* *secureboot.mdm_operations* - (Apple Silicon) Allow remote (MDM) management of kernel extensions and automatic software updates (1 if allowed)

**mechanism** - keyword, text.text

* *authorization_mechanisms.mechanism* - Name of the mechanism that will be called

**media_name** - keyword, text.text

* *disk_events.media_name* - Disk event media name string

**mem** - keyword, number.double

* *docker_container_processes.mem* - Memory utilization as percentage

**member_config_description** - keyword, text.text

* *lxd_cluster.member_config_description* - Config description

**member_config_entity** - keyword, text.text

* *lxd_cluster.member_config_entity* - Type of configuration parameter for this node

**member_config_key** - keyword, text.text

* *lxd_cluster.member_config_key* - Config key

**member_config_name** - keyword, text.text

* *lxd_cluster.member_config_name* - Name of configuration parameter

**member_config_value** - keyword, text.text

* *lxd_cluster.member_config_value* - Config value

**memory** - keyword, number.long

* *docker_info.memory* - Total memory

**memory_array_error_address** - keyword, text.text

* *memory_error_info.memory_array_error_address* - 32 bit physical address of the error based on the addressing of the bus to which the memory array is connected

**memory_array_handle** - keyword, text.text

* *memory_array_mapped_addresses.memory_array_handle* - Handle of the memory array associated with this structure

**memory_array_mapped_address_handle** - keyword, text.text

* *memory_device_mapped_addresses.memory_array_mapped_address_handle* - Handle of the memory array mapped address to which this device range is mapped to

**memory_available** - keyword, number.long

* *memory_info.memory_available* - The amount of physical RAM, in bytes, available for starting new applications, without swapping

**memory_cached** - keyword, number.long

* *docker_container_stats.memory_cached* - Memory cached

**memory_device_handle** - keyword, text.text

* *memory_device_mapped_addresses.memory_device_handle* - Handle of the memory device structure associated with this structure

**memory_error_correction** - keyword, text.text

* *memory_arrays.memory_error_correction* - Primary hardware error correction or detection method supported

**memory_error_info_handle** - keyword, text.text

* *memory_arrays.memory_error_info_handle* - Handle, or instance number, associated with any error that was detected for the array

**memory_free** - keyword, number.long

* *memory_info.memory_free* - The amount of physical RAM, in bytes, left unused by the system

**memory_limit** - keyword, number.long

* *docker_container_stats.memory_limit* - Memory limit
* *docker_info.memory_limit* - 1 if memory limit support is enabled. 0 otherwise

**memory_max_usage** - keyword, number.long

* *docker_container_stats.memory_max_usage* - Memory maximum usage

**memory_total** - keyword, number.long

* *memory_info.memory_total* - Total amount of physical RAM, in bytes

**memory_type** - keyword, text.text

* *memory_devices.memory_type* - Type of memory used

**memory_type_details** - keyword, text.text

* *memory_devices.memory_type_details* - Additional details for memory device

**memory_usage** - keyword, number.long

* *docker_container_stats.memory_usage* - Memory usage

**message** - keyword, text.text

* *apparmor_events.message* - Raw audit message
* *asl.message* - Message text.
* *lxd_cluster_members.message* - Message from the node (Online/Offline)
* *selinux_events.message* - Message
* *syslog_events.message* - The syslog message
* *unified_log.message* - composed message
* *user_events.message* - Message from the event

**metadata_endpoint** - keyword, text.text

* *ycloud_instance_metadata.metadata_endpoint* - Endpoint used to fetch VM metadata

**metalink** - keyword, text.text

* *yum_sources.metalink* - Metalink URL

**method** - keyword, text.text

* *curl.method* - The HTTP method for the request

**metric** - keyword, number.long

* *interface_details.metric* - Metric based on the speed of the interface
* *routes.metric* - Cost of route. Lowest is preferred

**metric_name** - keyword, text.text

* *prometheus_metrics.metric_name* - Name of collected Prometheus metric

**metric_value** - keyword, number.double

* *prometheus_metrics.metric_value* - Value of collected Prometheus metric

**mft_entry** - keyword, number.long

* *shellbags.mft_entry* - Directory master file table entry.

**mft_sequence** - keyword, number.long

* *shellbags.mft_sequence* - Directory master file table sequence.

**mime_encoding** - keyword, text.text

* *magic.mime_encoding* - MIME encoding data from libmagic

**mime_type** - keyword, text.text

* *magic.mime_type* - MIME type data from libmagic

**min** - keyword, number.long

* *fan_speed_sensors.min* - Minimum speed
* *shadow.min* - Minimal number of days between password changes

**min_api_version** - keyword, text.text

* *docker_version.min_api_version* - Minimum API version supported

**min_version** - keyword, text.text

* *xprotect_meta.min_version* - The minimum allowed plugin version.

**min_voltage** - keyword, number.long

* *memory_devices.min_voltage* - Minimum operating voltage of device in millivolts

**minimum_password_age** - keyword, number.long

* *security_profile_info.minimum_password_age* - Determines the minimum number of days that a password must be used before the user can change it

**minimum_password_length** - keyword, number.long

* *security_profile_info.minimum_password_length* - Determines the least number of characters that can make up a password for a user account

**minimum_system_version** - keyword, text.text

* *apps.minimum_system_version* - Minimum version of macOS required for the app to run

**minor** - keyword, number.long

* *os_version.minor* - Minor release version

**minor_version** - keyword, number.long

* *windows_crashes.minor_version* - Windows minor version of the machine

**minute** - keyword, text.text

* *crontab.minute* - The exact minute for the job

**minutes** - keyword, number.long

* *time.minutes* - Current minutes in UTC
* *uptime.minutes* - Minutes of uptime

**minutes_to_full_charge** - keyword, number.long

* *battery.minutes_to_full_charge* - The number of minutes until the battery is fully charged. This value is -1 if this time is still being calculated. On Windows this is calculated from the charge rate and capacity and may not agree with the number reported in "Power & Battery"

**minutes_until_empty** - keyword, number.long

* *battery.minutes_until_empty* - The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated

**mirror** - keyword, number.long

* *connected_displays.mirror* - If the display is mirrored or not. This field is 1 if mirrored and 0 if not mirrored.

**mirrorlist** - keyword, text.text

* *yum_sources.mirrorlist* - Mirrorlist URL

**mnt_namespace** - keyword, text.text

* *docker_containers.mnt_namespace* - Mount namespace
* *process_namespaces.mnt_namespace* - mnt namespace inode

**mode** - keyword, text.text

* *apparmor_profiles.mode* - How the policy is applied.
* *device_file.mode* - Permission bits
* *docker_container_mounts.mode* - Mount options (rw, ro)
* *file.mode* - Permission bits
* *file_events.mode* - Permission bits
* *package_bom.mode* - Expected permissions
* *process_events.mode* - File mode permissions
* *process_open_pipes.mode* - Pipe open mode (r/w)
* *rpm_package_files.mode* - File permissions mode from info DB
* *wifi_status.mode* - The current operating mode for the Wi-Fi interface

**model** - keyword, text.text

* *battery.model* - The battery’s model number
* *block_devices.model* - Block device model string identifier
* *chassis_info.model* - The model of the chassis.
* *cpu_info.model* - The model of the CPU.
* *hardware_events.model* - Hardware device model
* *pci_devices.model* - PCI Device model
* *usb_devices.model* - USB Device model string
* *video_info.model* - The model of the gpu.

**model_id** - keyword, text.text

* *hardware_events.model_id* - Hex encoded Hardware model identifier
* *pci_devices.model_id* - Hex encoded PCI Device model identifier
* *usb_devices.model_id* - Hex encoded USB Device model identifier

**modified** - keyword, text.text

* *authorizations.modified* - Label top-level key
* *keychain_items.modified* - Date of last modification

**modified_time** - keyword, number.long

* *package_bom.modified_time* - Timestamp the file was installed
* *shellbags.modified_time* - Directory Modified time.
* *shimcache.modified_time* - File Modified time.

**module** - keyword, text.text

* *windows_crashes.module* - Path of the crashed module within the process

**module_backtrace** - keyword, text.text

* *kernel_panics.module_backtrace* - Modules appearing in the crashed module’s backtrace

**module_path** - keyword, text.text

* *services.module_path* - Path to ServiceDll

**month** - keyword, text.text

* *crontab.month* - The month of the year for the job
* *time.month* - Current month in UTC

**mount_namespace_id** - keyword, text.text

* *deb_packages.mount_namespace_id* - Mount namespace id
* *file.mount_namespace_id* - Mount namespace id
* *hash.mount_namespace_id* - Mount namespace id
* *npm_packages.mount_namespace_id* - Mount namespace id
* *os_version.mount_namespace_id* - Mount namespace id
* *rpm_packages.mount_namespace_id* - Mount namespace id

**mount_point** - keyword, text.text

* *docker_volumes.mount_point* - Mount point

**mountable** - keyword, number.long

* *disk_events.mountable* - 1 if mountable, 0 if not

**mtime** - keyword

* *device_file.mtime* - Last modification time
* *file.mtime* - Last modification time
* *file_events.mtime* - Last modification time
* *gatekeeper_approved_apps.mtime* - Last modification time
* *process_events.mtime* - File modification in UNIX time
* *quicklook_cache.mtime* - Parsed version date field
* *registry.mtime* - timestamp of the most recent registry write

**mtu** - keyword, number.long

* *interface_details.mtu* - Network MTU
* *lxd_networks.mtu* - MTU size
* *routes.mtu* - Maximum Transmission Unit for the route

**name** - keyword, text.text

* *acpi_tables.name* - ACPI table name
* *ad_config.name* - The macOS-specific configuration name
* *apparmor_events.name* - Process name
* *apparmor_profiles.name* - Policy name.
* *apps.name* - Name of the Name.app folder
* *apt_sources.name* - Repository name
* *autoexec.name* - Name of the program
* *azure_instance_metadata.name* - Name of the VM
* *block_devices.name* - Block device name
* *browser_plugins.name* - Plugin display name
* *chocolatey_packages.name* - Package display name
* *chrome_extensions.name* - Extension display name
* *connected_displays.name* - The name of the display.
* *cups_destinations.name* - Name of the printer
* *deb_packages.name* - Package name
* *disk_encryption.name* - Disk name
* *disk_events.name* - Disk event name
* *disk_info.name* - The label of the disk object.
* *dns_cache.name* - DNS record name
* *docker_container_mounts.name* - Optional mount name
* *docker_container_networks.name* - Network name
* *docker_container_processes.name* - The process path or shorthand argv[0]
* *docker_container_stats.name* - Container name
* *docker_containers.name* - Container name
* *docker_info.name* - Name of the docker host
* *docker_networks.name* - Network name
* *docker_volume_labels.name* - Volume name
* *docker_volumes.name* - Volume name
* *etc_protocols.name* - Protocol name
* *etc_services.name* - Service name
* *fan_speed_sensors.name* - Fan name
* *firefox_addons.name* - Addon display name
* *homebrew_packages.name* - Package name
* *ie_extensions.name* - Extension display name
* *iokit_devicetree.name* - Device node name
* *iokit_registry.name* - Default name of the node
* *kernel_extensions.name* - Extension label
* *kernel_modules.name* - Module name
* *kernel_panics.name* - Process name corresponding to crashed thread
* *launchd.name* - File name of plist (used by launchd)
* *lxd_certificates.name* - Name of the certificate
* *lxd_instance_config.name* - Instance name
* *lxd_instance_devices.name* - Instance name
* *lxd_instances.name* - Instance name
* *lxd_networks.name* - Name of the network
* *lxd_storage_pools.name* - Name of the storage pool
* *managed_policies.name* - Policy key name
* *md_personalities.name* - Name of personality supported by kernel
* *memory_map.name* - Region name
* *npm_packages.name* - Package display name
* *ntdomains.name* - The label by which the object is known.
* *nvram.name* - Variable name
* *os_version.name* - Distribution or product name
* *osquery_events.name* - Event publisher or subscriber name
* *osquery_extensions.name* - Extension’s name
* *osquery_flags.name* - Flag name
* *osquery_packs.name* - The given name for this query pack
* *osquery_registry.name* - Name of the plugin item
* *osquery_schedule.name* - The given name for this query
* *package_install_history.name* - Package display name
* *physical_disk_performance.name* - Name of the physical disk
* *pipes.name* - Name of the pipe
* *power_sensors.name* - Name of power source
* *processes.name* - The process path or shorthand argv[0]
* *programs.name* - Commonly used product name.
* *python_packages.name* - Package display name
* *registry.name* - Name of the registry value entry
* *rpm_packages.name* - RPM package name
* *safari_extensions.name* - Extension display name
* *scheduled_tasks.name* - Name of the scheduled task
* *services.name* - Service name
* *shared_folders.name* - The shared name of the folder as it appears to other users
* *shared_resources.name* - Alias given to a path set up as a share on a computer system running Windows.
* *startup_items.name* - Name of startup item
* *system_controls.name* - Full sysctl MIB name
* *temperature_sensors.name* - Name of temperature source
* *vscode_extensions.name* - Extension Name
* *windows_firewall_rules.name* - Friendly name of the rule
* *windows_optional_features.name* - Name of the feature
* *windows_search.name* - The name of the item
* *windows_security_products.name* - Name of product
* *wmi_bios_info.name* - Name of the Bios setting
* *wmi_cli_event_consumers.name* - Unique name of a consumer.
* *wmi_event_filters.name* - Unique identifier of an event filter.
* *wmi_script_event_consumers.name* - Unique identifier for the event consumer.
* *xprotect_entries.name* - Description of XProtected malware
* *xprotect_reports.name* - Description of XProtected malware
* *ycloud_instance_metadata.name* - Name of the VM
* *yum_sources.name* - Repository name

**name_constraints** - keyword, text.text

* *curl_certificate.name_constraints* - Name Constraints

**namespace** - keyword, text.text

* *apparmor_events.namespace* - AppArmor namespace

**native** - keyword, number.long

* *browser_plugins.native* - Plugin requires native execution

**net_namespace** - keyword, text.text

* *docker_containers.net_namespace* - Network namespace
* *listening_ports.net_namespace* - The inode number of the network namespace
* *process_namespaces.net_namespace* - net namespace inode
* *process_open_sockets.net_namespace* - The inode number of the network namespace

**netmask** - keyword, text.text

* *dns_resolvers.netmask* - Address (sortlist) netmask length
* *routes.netmask* - Netmask length

**network_id** - keyword, text.text

* *docker_container_networks.network_id* - Network ID

**network_name** - keyword, text.text

* *wifi_networks.network_name* - Name of the network
* *wifi_status.network_name* - Name of the network
* *wifi_survey.network_name* - Name of the network

**network_rx_bytes** - keyword, number.long

* *docker_container_stats.network_rx_bytes* - Total network bytes read

**network_tx_bytes** - keyword, number.long

* *docker_container_stats.network_tx_bytes* - Total network bytes transmitted

**new_administrator_name** - keyword, text.text

* *security_profile_info.new_administrator_name* - Determines the name of the Administrator account on the local computer

**new_guest_name** - keyword, text.text

* *security_profile_info.new_guest_name* - Determines the name of the Guest account on the local computer

**next_run_time** - keyword, number.long

* *scheduled_tasks.next_run_time* - Timestamp the task is scheduled to run next

**nice** - keyword, number.long

* *cpu_time.nice* - Time spent in user mode with low priority (nice)
* *docker_container_processes.nice* - Process nice level (-20 to 20, default 0)
* *processes.nice* - Process nice level (-20 to 20, default 0)

**no_proxy** - keyword, text.text

* *docker_info.no_proxy* - Comma-separated list of domain extensions proxy should not be used for

**node** - keyword, text.text

* *augeas.node* - The node path of the configuration item

**node_ref_number** - keyword, text.text

* *ntfs_journal_events.node_ref_number* - The ordinal that associates a journal record with a filename

**noise** - keyword, number.long

* *wifi_status.noise* - The current noise measurement (dBm)
* *wifi_survey.noise* - The current noise measurement (dBm)

**not_valid_after** - keyword, text.text

* *certificates.not_valid_after* - Certificate expiration data

**not_valid_before** - keyword, text.text

* *certificates.not_valid_before* - Lower bound of valid date

**nr_raid_disks** - keyword, number.long

* *md_devices.nr_raid_disks* - Number of partitions or disk devices to comprise the array

**ntime** - keyword, text.text

* *bpf_process_events.ntime* - The nsecs uptime timestamp as obtained from BPF
* *bpf_socket_events.ntime* - The nsecs uptime timestamp as obtained from BPF

**num_procs** - keyword, number.long

* *docker_container_stats.num_procs* - Number of processors

**number** - keyword, number.long

* *etc_protocols.number* - Protocol number
* *oem_strings.number* - The string index of the structure
* *smbios_tables.number* - Table entry number

**number_memory_devices** - keyword, number.long

* *memory_arrays.number_memory_devices* - Number of memory devices on array

**number_of_cores** - keyword, text.text

* *cpu_info.number_of_cores* - The number of cores of the CPU.

**number_of_efficiency_cores** - keyword, number.long

* *cpu_info.number_of_efficiency_cores* - The number of efficiency cores of the CPU. Only available on Apple Silicon

**number_of_performance_cores** - keyword, number.long

* *cpu_info.number_of_performance_cores* - The number of performance cores of the CPU. Only available on Apple Silicon

**object_name** - keyword, text.text

* *winbaseobj.object_name* - Object Name

**object_path** - keyword, text.text

* *systemd_units.object_path* - The object path for this unit

**object_type** - keyword, text.text

* *winbaseobj.object_type* - Object Type

**obytes** - keyword, number.long

* *interface_details.obytes* - Output bytes

**odrops** - keyword, number.long

* *interface_details.odrops* - Output drops

**oerrors** - keyword, number.long

* *interface_details.oerrors* - Output errors

**offer** - keyword, text.text

* *azure_instance_metadata.offer* - Offer information for the VM image (Azure image gallery VMs only)

**offset** - keyword, number.long

* *device_partitions.offset* - Byte offset from the start of the volume
* *process_memory_map.offset* - Offset into mapped path

**oid** - keyword, text.text

* *system_controls.oid* - Control MIB

**old_path** - keyword, text.text

* *ntfs_journal_events.old_path* - Old path (renames only)

**on_demand** - keyword, text.text

* *launchd.on_demand* - Deprecated key, replaced by keep_alive

**on_disk** - keyword, number.long

* *processes.on_disk* - The process path exists yes=1, no=0, unknown=-1

**online** - keyword, number.long

* *connected_displays.online* - The online status of the display. This field is 1 if the display is online and 0 if it is offline.

**online_cpus** - keyword, number.long

* *docker_container_stats.online_cpus* - Online CPUs

**oom_kill_disable** - keyword, number.long

* *docker_info.oom_kill_disable* - 1 if Out-of-memory kill is disabled. 0 otherwise

**opackets** - keyword, number.long

* *interface_details.opackets* - Output packets

**opaque_version** - keyword, text.text

* *gatekeeper.opaque_version* - Version of Gatekeeper’s gkopaque.bundle

**operation** - keyword, text.text

* *apparmor_events.operation* - Permission requested by the process
* *process_file_events.operation* - Operation type
* *windows_update_history.operation* - Operation on an update

**option** - keyword, text.text

* *ad_config.option* - Canonical name of option
* *ssh_configs.option* - The option and value

**option_name** - keyword, text.text

* *cups_destinations.option_name* - Option name

**option_value** - keyword, text.text

* *cups_destinations.option_value* - Option value

**optional** - keyword, number.long

* *xprotect_entries.optional* - Match any of the identities/patterns for this XProtect name

**optional_permissions** - keyword, text.text

* *chrome_extensions.optional_permissions* - The permissions optionally required by the extensions

**optional_permissions_json** - keyword, text.text

* *chrome_extensions.optional_permissions_json* - The JSON-encoded permissions optionally required by the extensions

**options** - keyword, text.text

* *authorized_keys.options* - Optional list of login options
* *dns_resolvers.options* - Resolver options
* *nfs_shares.options* - Options string set on the export share

**organization** - keyword, text.text

* *curl_certificate.organization* - Organization issued to

**organization_unit** - keyword, text.text

* *curl_certificate.organization_unit* - Organization unit issued to

**original_filename** - keyword, text.text

* *file.original_filename* - (Executable files only) Original filename

**original_parent** - keyword, number.long

* *es_process_events.original_parent* - Original parent process ID in case of reparenting

**original_program_name** - keyword, text.text

* *authenticode.original_program_name* - The original program name that the publisher has signed

**os** - keyword, text.text

* *docker_info.os* - Operating system
* *docker_version.os* - Operating system
* *lxd_images.os* - OS on which image is based
* *lxd_instances.os* - The OS of this instance

**os_type** - keyword, text.text

* *azure_instance_metadata.os_type* - Linux or Windows
* *docker_info.os_type* - Operating system type

**os_version** - keyword, text.text

* *kernel_panics.os_version* - Version of the operating system

**other** - keyword, text.text

* *md_devices.other* - Other information associated with array from /proc/mdstat

**other_run_times** - keyword, text.text

* *prefetch.other_run_times* - Other execution times in prefetch file.

**ouid** - keyword, number.long

* *apparmor_events.ouid* - Object owner’s user ID

**outiface** - keyword, text.text

* *iptables.outiface* - Output interface for the rule.

**outiface_mask** - keyword, text.text

* *iptables.outiface_mask* - Output interface mask for the rule.

**output_bit** - keyword, number.long

* *cpuid.output_bit* - Bit in register value for feature value

**output_register** - keyword, text.text

* *cpuid.output_register* - Register used to for feature value

**output_size** - keyword, number.long

* *osquery_schedule.output_size* - Cumulative total number of bytes generated by the resultant rows of the query

**overflows** - keyword, text.text

* *process_events.overflows* - List of structures that overflowed

**owned** - keyword, number.long

* *tpm_info.owned* - TPM is owned

**owner** - keyword, text.text

* *windows_search.owner* - The owner of the item

**owner_gid** - keyword, number.long

* *process_events.owner_gid* - File owner group ID

**owner_uid** - keyword, number.long

* *process_events.owner_uid* - File owner user ID
* *shared_memory.owner_uid* - User ID of owning process

**owner_uuid** - keyword, number.long

* *osquery_registry.owner_uuid* - Extension route UUID (0 for core)

**package** - keyword, text.text

* *portage_keywords.package* - Package name
* *portage_packages.package* - Package name
* *portage_use.package* - Package name
* *rpm_package_files.package* - RPM package name

**package_filename** - keyword, text.text

* *package_receipts.package_filename* - Filename of original .pkg file

**package_group** - keyword, text.text

* *rpm_packages.package_group* - Package group

**package_id** - keyword, text.text

* *package_install_history.package_id* - Label packageIdentifiers
* *package_receipts.package_id* - Package domain identifier

**packets** - keyword, number.long

* *iptables.packets* - Number of matching packets for this rule.

**packets_received** - keyword, number.long

* *lxd_networks.packets_received* - Number of packets received on this network

**packets_sent** - keyword, number.long

* *lxd_networks.packets_sent* - Number of packets sent on this network

**page_ins** - keyword, number.long

* *virtual_memory_info.page_ins* - The total number of requests for pages from a pager.

**page_outs** - keyword, number.long

* *virtual_memory_info.page_outs* - Total number of pages paged out.

**parent** - keyword

* *apparmor_events.parent* - Parent process PID
* *block_devices.parent* - Block device parent name
* *bpf_process_events.parent* - Parent process ID
* *bpf_socket_events.parent* - Parent process ID
* *crashes.parent* - Parent PID of the crashed process
* *docker_container_processes.parent* - Process parent’s PID
* *es_process_events.parent* - Parent process ID
* *es_process_file_events.parent* - Parent process ID
* *iokit_devicetree.parent* - Parent device registry ID
* *iokit_registry.parent* - Parent registry ID
* *process_events.parent* - Process parent’s PID, or -1 if cannot be determined.
* *processes.parent* - Process parent’s PID

**parent_process_sequence_number** - keyword, number.long

* *process_etw_events.parent_process_sequence_number* - Parent Process Sequence Number - Present only on ProcessStart events

**parent_ref_number** - keyword, text.text

* *ntfs_journal_events.parent_ref_number* - The ordinal that associates a journal record with a filename’s parent directory

**part_number** - keyword, text.text

* *memory_devices.part_number* - Manufacturer specific serial number of memory device

**partial** - keyword

* *ntfs_journal_events.partial* - Set to 1 if either path or old_path only contains the file or folder name
* *process_file_events.partial* - True if this is a partial event (i.e.: this process existed before we started osquery)

**partition** - keyword, text.text

* *device_file.partition* - A partition number
* *device_hash.partition* - A partition number
* *device_partitions.partition* - A partition number or description

**partition_row_position** - keyword, number.long

* *memory_device_mapped_addresses.partition_row_position* - Identifies the position of the referenced memory device in a row of the address partition

**partition_width** - keyword, number.long

* *memory_array_mapped_addresses.partition_width* - Number of memory devices that form a single row of memory for the address partition of this structure

**partitions** - keyword, number.long

* *disk_info.partitions* - Number of detected partitions on disk.

**partner_fd** - keyword, number.long

* *process_open_pipes.partner_fd* - File descriptor of shared pipe at partner’s end

**partner_mode** - keyword, text.text

* *process_open_pipes.partner_mode* - Mode of shared pipe at partner’s end

**partner_pid** - keyword, number.long

* *process_open_pipes.partner_pid* - Process ID of partner process sharing a particular pipe

**passpoint** - keyword, number.long

* *wifi_networks.passpoint* - 1 if Passpoint is supported, 0 otherwise

**password_complexity** - keyword, number.long

* *security_profile_info.password_complexity* - Determines whether passwords must meet a series of strong-password guidelines

**password_history_size** - keyword, number.long

* *security_profile_info.password_history_size* - Number of unique new passwords that must be associated with a user account before an old password can be reused

**password_last_set_time** - keyword, number.double

* *account_policy_data.password_last_set_time* - The time the password was last changed

**password_status** - keyword, text.text

* *shadow.password_status* - Password status

**patch** - keyword, number.long

* *os_version.patch* - Optional patch release

**path** - keyword, text.text

* *alf_exceptions.path* - Path to the executable that is excepted
* *apparmor_profiles.path* - Unique, aa-status compatible, policy identifier.
* *appcompat_shims.path* - This is the path to the SDB database.
* *apps.path* - Absolute and full Name.app path
* *augeas.path* - The path to the configuration file
* *authenticode.path* - Must provide a path or directory
* *autoexec.path* - Path to the executable
* *background_activities_moderator.path* - Application file path.
* *bpf_process_events.path* - Binary path
* *bpf_socket_events.path* - Path of executed file
* *browser_plugins.path* - Path to plugin bundle
* *carves.path* - The path of the requested carve
* *certificates.path* - Path to Keychain or PEM bundle
* *chocolatey_packages.path* - Path at which this package resides
* *chrome_extension_content_scripts.path* - Path to extension folder
* *chrome_extensions.path* - Path to extension folder
* *crashes.path* - Path to the crashed process
* *crontab.path* - File parsed
* *device_file.path* - A logical path within the device node
* *disk_events.path* - Path of the DMG file accessed
* *docker_container_fs_changes.path* - FIle or directory path relative to rootfs
* *docker_containers.path* - Container path
* *es_process_events.path* - Path of executed file
* *es_process_file_events.path* - Path of executed file
* *extended_attributes.path* - Absolute file path
* *file.path* - Absolute file path
* *firefox_addons.path* - Path to plugin bundle
* *gatekeeper_approved_apps.path* - Path of executable allowed to run
* *hardware_events.path* - Local device path assigned (optional)
* *hash.path* - Must provide a path or directory
* *homebrew_packages.path* - Package install path
* *ie_extensions.path* - Path to executable
* *kernel_extensions.path* - Optional path to extension bundle
* *kernel_info.path* - Kernel path
* *kernel_panics.path* - Location of log file
* *keychain_acls.path* - The path of the authorized application
* *keychain_items.path* - Path to keychain containing item
* *launchd.path* - Path to daemon or agent plist
* *launchd_overrides.path* - Path to daemon or agent plist
* *listening_ports.path* - Path for UNIX domain sockets
* *magic.path* - Absolute path to target file
* *mdfind.path* - Path of the file returned from spotlight
* *mdls.path* - Path of the file
* *mounts.path* - Mounted device path
* *npm_packages.path* - Path at which this module resides
* *ntfs_acl_permissions.path* - Path to the file or directory.
* *ntfs_journal_events.path* - Path
* *office_mru.path* - File path
* *osquery_extensions.path* - Path of the extension’s Thrift connection or library path
* *package_bom.path* - Path of package bom
* *package_receipts.path* - Path of receipt plist
* *plist.path* - (required) read preferences from a plist
* *prefetch.path* - Prefetch file path.
* *process_etw_events.path* - Path of executed binary
* *process_events.path* - Path of executed file
* *process_file_events.path* - The path associated with the event
* *process_memory_map.path* - Path to mapped file or mapped type
* *process_open_files.path* - Filesystem path of descriptor
* *process_open_sockets.path* - For UNIX sockets (family=AF_UNIX), the domain path
* *processes.path* - Path to executed binary
* *python_packages.path* - Path at which this module resides
* *quicklook_cache.path* - Path of file
* *registry.path* - Full path to the value
* *rpm_package_files.path* - File path within the package
* *safari_extensions.path* - Path to extension XAR bundle
* *sandboxes.path* - Path to sandbox container directory
* *scheduled_tasks.path* - Path to the executable to be run
* *services.path* - Path to Service Executable
* *shared_folders.path* - Absolute path of shared folder on the local system
* *shared_resources.path* - Local path of the Windows share.
* *shellbags.path* - Directory name.
* *shimcache.path* - This is the path to the executed file.
* *signature.path* - Must provide a path or directory
* *socket_events.path* - Path of executed file
* *startup_items.path* - Path of startup item
* *suid_bin.path* - Binary path
* *system_extensions.path* - Original path of system extension
* *user_events.path* - Supplied path from event
* *user_ssh_keys.path* - Path to key file
* *userassist.path* - Application file path.
* *vscode_extensions.path* - Extension path
* *windows_crashes.path* - Path of the executable file for the crashed process
* *windows_search.path* - The full path of the item.
* *yara.path* - The path scanned

**pci_class** - keyword, text.text

* *pci_devices.pci_class* - PCI Device class

**pci_class_id** - keyword, text.text

* *pci_devices.pci_class_id* - PCI Device class ID in hex format

**pci_slot** - keyword, text.text

* *interface_details.pci_slot* - PCI slot number
* *pci_devices.pci_slot* - PCI Device used slot

**pci_subclass** - keyword, text.text

* *pci_devices.pci_subclass* - PCI Device subclass

**pci_subclass_id** - keyword, text.text

* *pci_devices.pci_subclass_id* - PCI Device  subclass in hex format

**pem** - keyword, text.text

* *curl_certificate.pem* - Certificate PEM format

**percent_disk_read_time** - keyword, number.long

* *physical_disk_performance.percent_disk_read_time* - Percentage of elapsed time that the selected disk drive is busy servicing read requests

**percent_disk_time** - keyword, number.long

* *physical_disk_performance.percent_disk_time* - Percentage of elapsed time that the selected disk drive is busy servicing read or write requests

**percent_disk_write_time** - keyword, number.long

* *physical_disk_performance.percent_disk_write_time* - Percentage of elapsed time that the selected disk drive is busy servicing write requests

**percent_idle_time** - keyword, number.long

* *physical_disk_performance.percent_idle_time* - Percentage of time during the sample interval that the disk was idle

**percent_processor_time** - keyword, number.long

* *processes.percent_processor_time* - Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks.

**percent_remaining** - keyword, number.long

* *battery.percent_remaining* - The percentage of battery remaining before it is drained

**percentage_encrypted** - keyword, number.long

* *bitlocker_info.percentage_encrypted* - The percentage of the drive that is encrypted.

**perf_ctl** - keyword, number.long

* *msr.perf_ctl* - Performance setting for the processor.

**perf_status** - keyword, number.long

* *msr.perf_status* - Performance status for the processor.

**period** - keyword, text.text

* *load_average.period* - Period over which the average is calculated.

**permanent** - keyword, text.text

* *arp_cache.permanent* - 1 for true, 0 for false

**permissions** - keyword, text.text

* *chrome_extensions.permissions* - The permissions required by the extension
* *kernel_keys.permissions* - The key permissions, expressed as four hexadecimal bytes containing, from left to right, the possessor, user, group, and other permissions.
* *process_memory_map.permissions* - r=read, w=write, x=execute, p=private (cow)
* *shared_memory.permissions* - Memory segment permissions
* *suid_bin.permissions* - Binary permissions

**permissions_json** - keyword, text.text

* *chrome_extensions.permissions_json* - The JSON-encoded permissions required by the extension

**persistent** - keyword, number.long

* *chrome_extensions.persistent* - 1 If extension is persistent across all tabs else 0

**persistent_volume_id** - keyword, text.text

* *bitlocker_info.persistent_volume_id* - Persistent ID of the drive.

**personal_hotspot** - keyword, number.long

* *wifi_networks.personal_hotspot* - 1 if this network is a personal hotspot, 0 otherwise

**pgroup** - keyword, number.long

* *docker_container_processes.pgroup* - Process group
* *processes.pgroup* - Process group

**physical_adapter** - keyword, number.long

* *interface_details.physical_adapter* - Indicates whether the adapter is a physical or a logical adapter.

**physical_memory** - keyword, number.long

* *system_info.physical_memory* - Total physical memory in bytes

**physical_presence_version** - keyword, text.text

* *tpm_info.physical_presence_version* - Version of the Physical Presence Interface

**pid** - keyword, number.long

* *apparmor_events.pid* - Process ID
* *asl.pid* - Sending process ID encoded as a string.  Set automatically.
* *bpf_process_events.pid* - Process ID
* *bpf_socket_events.pid* - Process ID
* *crashes.pid* - Process (or thread) ID of the crashed process
* *docker_container_processes.pid* - Process ID
* *docker_containers.pid* - Identifier of the initial process
* *es_process_events.pid* - Process (or thread) ID
* *es_process_file_events.pid* - Process (or thread) ID
* *last.pid* - Process (or thread) ID
* *listening_ports.pid* - Process (or thread) ID
* *logged_in_users.pid* - Process (or thread) ID
* *lxd_instances.pid* - Instance’s process ID
* *osquery_info.pid* - Process (or thread/handle) ID
* *pipes.pid* - Process ID of the process to which the pipe belongs
* *process_envs.pid* - Process (or thread) ID
* *process_etw_events.pid* - Process ID
* *process_events.pid* - Process (or thread) ID
* *process_file_events.pid* - Process ID
* *process_memory_map.pid* - Process (or thread) ID
* *process_namespaces.pid* - Process (or thread) ID
* *process_open_files.pid* - Process (or thread) ID
* *process_open_pipes.pid* - Process ID
* *process_open_sockets.pid* - Process (or thread) ID
* *processes.pid* - Process (or thread) ID
* *running_apps.pid* - The pid of the application
* *seccomp_events.pid* - Process ID
* *services.pid* - the Process ID of the service
* *shared_memory.pid* - Process ID to last use the segment
* *socket_events.pid* - Process (or thread) ID
* *unified_log.pid* - the pid of the process that made the entry
* *user_events.pid* - Process (or thread) ID
* *windows_crashes.pid* - Process ID of the crashed process
* *windows_eventlog.pid* - Process ID which emitted the event record

**pid_namespace** - keyword, text.text

* *docker_containers.pid_namespace* - PID namespace
* *process_namespaces.pid_namespace* - pid namespace inode

**pid_with_namespace** - keyword, number.long

* *apt_sources.pid_with_namespace* - Pids that contain a namespace
* *authorized_keys.pid_with_namespace* - Pids that contain a namespace
* *crontab.pid_with_namespace* - Pids that contain a namespace
* *deb_packages.pid_with_namespace* - Pids that contain a namespace
* *dns_resolvers.pid_with_namespace* - Pids that contain a namespace
* *etc_hosts.pid_with_namespace* - Pids that contain a namespace
* *file.pid_with_namespace* - Pids that contain a namespace
* *groups.pid_with_namespace* - Pids that contain a namespace
* *hash.pid_with_namespace* - Pids that contain a namespace
* *npm_packages.pid_with_namespace* - Pids that contain a namespace
* *os_version.pid_with_namespace* - Pids that contain a namespace
* *python_packages.pid_with_namespace* - Pids that contain a namespace
* *rpm_packages.pid_with_namespace* - Pids that contain a namespace
* *suid_bin.pid_with_namespace* - Pids that contain a namespace
* *user_ssh_keys.pid_with_namespace* - Pids that contain a namespace
* *users.pid_with_namespace* - Pids that contain a namespace
* *yara.pid_with_namespace* - Pids that contain a namespace
* *yum_sources.pid_with_namespace* - Pids that contain a namespace

**pids** - keyword, number.long

* *docker_container_stats.pids* - Number of processes

**pixels** - keyword, text.text

* *connected_displays.pixels* - The number of pixels of the display.

**pk_hash** - keyword, text.text

* *keychain_items.pk_hash* - Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2)

**placement_group_id** - keyword, text.text

* *azure_instance_metadata.placement_group_id* - Placement group for the VM scale set

**platform** - keyword, text.text

* *os_version.platform* - OS Platform or ID
* *osquery_packs.platform* - Platforms this query is supported on

**platform_binary** - keyword, number.long

* *es_process_events.platform_binary* - Indicates if the binary is Apple signed binary (1) or not (0)

**platform_fault_domain** - keyword, text.text

* *azure_instance_metadata.platform_fault_domain* - Fault domain the VM is running in

**platform_info** - keyword, number.long

* *msr.platform_info* - Platform information.

**platform_like** - keyword, text.text

* *os_version.platform_like* - Closely related platforms

**platform_mask** - keyword, number.long

* *osquery_info.platform_mask* - The osquery platform bitmask

**platform_update_domain** - keyword, text.text

* *azure_instance_metadata.platform_update_domain* - Update domain the VM is running in

**plugin** - keyword, text.text

* *authorization_mechanisms.plugin* - Authorization plugin name

**pnp_device_id** - keyword, text.text

* *disk_info.pnp_device_id* - The unique identifier of the drive on the system.

**point_to_point** - keyword, text.text

* *interface_addresses.point_to_point* - PtP address for the interface

**policies** - keyword, text.text

* *curl_certificate.policies* - Certificate Policies

**policy** - keyword, text.text

* *iptables.policy* - Policy that applies for this rule.

**policy_constraints** - keyword, text.text

* *curl_certificate.policy_constraints* - Policy Constraints

**policy_content** - keyword, text.text

* *password_policy.policy_content* - Policy content

**policy_description** - keyword, text.text

* *password_policy.policy_description* - Policy description

**policy_identifier** - keyword, text.text

* *password_policy.policy_identifier* - Policy Identifier

**policy_mappings** - keyword, text.text

* *curl_certificate.policy_mappings* - Policy Mappings

**port** - keyword, number.long

* *docker_container_ports.port* - Port inside the container
* *etc_services.port* - Service port number
* *listening_ports.port* - Transport layer port

**possibly_hidden** - keyword, number.long

* *wifi_networks.possibly_hidden* - 1 if network is possibly a hidden network, 0 otherwise

**ppid** - keyword, number.long

* *process_etw_events.ppid* - Parent Process ID
* *process_file_events.ppid* - Parent process ID

**pre_cpu_kernelmode_usage** - keyword, number.long

* *docker_container_stats.pre_cpu_kernelmode_usage* - Last read CPU kernel mode usage

**pre_cpu_total_usage** - keyword, number.long

* *docker_container_stats.pre_cpu_total_usage* - Last read total CPU usage

**pre_cpu_usermode_usage** - keyword, number.long

* *docker_container_stats.pre_cpu_usermode_usage* - Last read CPU user mode usage

**pre_online_cpus** - keyword, number.long

* *docker_container_stats.pre_online_cpus* - Last read online CPUs

**pre_system_cpu_usage** - keyword, number.long

* *docker_container_stats.pre_system_cpu_usage* - Last read CPU system usage

**predicate** - keyword, text.text

* *unified_log.predicate* - predicate to search (see `log help predicates`), note that this is merged into the predicate created from the column constraints

**prefix** - keyword, text.text

* *homebrew_packages.prefix* - Homebrew install prefix

**preread** - keyword, number.long

* *docker_container_stats.preread* - UNIX time when stats were last read

**prerelease** - keyword, number.long

* *vscode_extensions.prerelease* - Pre release version

**principal** - keyword, text.text

* *ntfs_acl_permissions.principal* - User or group to which the ACE applies.

**printer_sharing** - keyword, number.long

* *sharing_preferences.printer_sharing* - 1 If printer sharing is enabled else 0

**priority** - keyword, text.text

* *deb_packages.priority* - Package priority

**privileged** - keyword, text.text

* *authorization_mechanisms.privileged* - If privileged it will run as root, else as an anonymous user
* *docker_containers.privileged* - Is the container privileged

**probe_error** - keyword, number.long

* *bpf_process_events.probe_error* - Set to 1 if one or more buffers could not be captured
* *bpf_socket_events.probe_error* - Set to 1 if one or more buffers could not be captured

**process** - keyword, text.text

* *alf_explicit_auths.process* - Process name that is explicitly allowed
* *unified_log.process* - the name of the process that made the entry

**process_being_tapped** - keyword, number.long

* *event_taps.process_being_tapped* - The process ID of the target application

**process_sequence_number** - keyword, number.long

* *process_etw_events.process_sequence_number* - Process Sequence Number - Present only on ProcessStart events

**process_type** - keyword, text.text

* *launchd.process_type* - Key describes the intended purpose of the job

**process_uptime** - keyword, number.long

* *windows_crashes.process_uptime* - Uptime of the process in seconds

**processes** - keyword, number.long

* *lxd_instances.processes* - Number of processes running inside this instance

**processing_time** - keyword, number.long

* *cups_jobs.processing_time* - How long the job took to process

**processor_number** - keyword, number.long

* *msr.processor_number* - The processor number as reported in /proc/cpuinfo

**processor_type** - keyword, text.text

* *cpu_info.processor_type* - The processor type, such as Central, Math, or Video.

**product_id** - keyword, text.text

* *connected_displays.product_id* - The product ID of the display.

**product_name** - keyword, text.text

* *tpm_info.product_name* - Product name of the TPM

**product_version** - keyword, text.text

* *file.product_version* - File product version

**profile** - keyword, text.text

* *apparmor_events.profile* - Apparmor profile name
* *chrome_extensions.profile* - The name of the Chrome profile that contains this extension

**profile_domain** - keyword, number.long

* *windows_firewall_rules.profile_domain* - 1 if the rule profile type is domain

**profile_path** - keyword, text.text

* *chrome_extension_content_scripts.profile_path* - The profile path
* *chrome_extensions.profile_path* - The profile path
* *logon_sessions.profile_path* - The home directory for the logon session.

**profile_private** - keyword, number.long

* *windows_firewall_rules.profile_private* - 1 if the rule profile type is private

**profile_public** - keyword, number.long

* *windows_firewall_rules.profile_public* - 1 if the rule profile type is public

**program** - keyword, text.text

* *launchd.program* - Path to target program

**program_arguments** - keyword, text.text

* *launchd.program_arguments* - Command line arguments passed to program

**propagation** - keyword, text.text

* *docker_container_mounts.propagation* - Mount propagation

**properties** - keyword, text.text

* *windows_search.properties* - Additional property values JSON

**protected** - keyword, number.long

* *app_schemes.protected* - 1 if this handler is protected (reserved) by macOS, else 0

**protection_disabled** - keyword, number.long

* *carbon_black_info.protection_disabled* - If the sensor is configured to report tamper events

**protection_status** - keyword, number.long

* *bitlocker_info.protection_status* - The bitlocker protection status of the drive.

**protection_type** - keyword, text.text

* *processes.protection_type* - The protection type of the process

**protocol** - keyword

* *bpf_socket_events.protocol* - The network protocol ID
* *etc_services.protocol* - Transport protocol (TCP/UDP)
* *iptables.protocol* - Protocol number identification.
* *listening_ports.protocol* - Transport protocol (TCP/UDP)
* *process_open_sockets.protocol* - Transport protocol (TCP/UDP)
* *socket_events.protocol* - The network protocol ID
* *usb_devices.protocol* - USB Device protocol
* *windows_firewall_rules.protocol* - IP protocol of the rule

**provider** - keyword, text.text

* *drivers.provider* - Driver provider

**provider_guid** - keyword, text.text

* *windows_eventlog.provider_guid* - Provider guid of the event
* *windows_events.provider_guid* - Provider guid of the event

**provider_name** - keyword, text.text

* *windows_eventlog.provider_name* - Provider name of the event
* *windows_events.provider_name* - Provider name of the event

**pseudo** - keyword, number.long

* *process_memory_map.pseudo* - 1 If path is a pseudo path, else 0

**public** - keyword, number.long

* *lxd_images.public* - Whether image is public (1) or not (0)

**publisher** - keyword, text.text

* *azure_instance_metadata.publisher* - Publisher of the VM image
* *osquery_events.publisher* - Name of the associated publisher
* *programs.publisher* - Name of the product supplier.
* *vscode_extensions.publisher* - Publisher Name

**publisher_id** - keyword, text.text

* *vscode_extensions.publisher_id* - Publisher ID

**purgeable** - keyword, number.long

* *virtual_memory_info.purgeable* - Total number of purgeable pages.

**purged** - keyword, number.long

* *virtual_memory_info.purged* - Total number of purged pages.

**query** - keyword, text.text

* *mdfind.query* - The query that was run to find the file
* *osquery_schedule.query* - The exact query to run
* *windows_search.query* - Windows search query
* *wmi_event_filters.query* - Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.

**query_language** - keyword, text.text

* *wmi_event_filters.query_language* - Query language that the query is written in.

**queue_directories** - keyword, text.text

* *launchd.queue_directories* - Similar to watch_paths but only with non-empty directories

**raid_disks** - keyword, number.long

* *md_devices.raid_disks* - Number of configured RAID disks in array

**raid_level** - keyword, number.long

* *md_devices.raid_level* - Current raid level of the array

**rapl_energy_status** - keyword, number.long

* *msr.rapl_energy_status* - Run Time Average Power Limiting energy status.

**rapl_power_limit** - keyword, number.long

* *msr.rapl_power_limit* - Run Time Average Power Limiting power limit.

**rapl_power_units** - keyword, number.long

* *msr.rapl_power_units* - Run Time Average Power Limiting power units.

**reactivated** - keyword, number.long

* *virtual_memory_info.reactivated* - Total number of reactivated pages.

**read** - keyword, number.long

* *docker_container_stats.read* - UNIX time when stats were read

**readonly** - keyword, number.long

* *nfs_shares.readonly* - 1 if the share is exported readonly else 0

**readonly_rootfs** - keyword, number.long

* *docker_containers.readonly_rootfs* - Is the root filesystem mounted as read only

**record_timestamp** - keyword, text.text

* *ntfs_journal_events.record_timestamp* - Journal record timestamp

**record_usn** - keyword, text.text

* *ntfs_journal_events.record_usn* - The update sequence number that identifies the journal record

**recovery_finish** - keyword, text.text

* *md_devices.recovery_finish* - Estimated duration of recovery activity

**recovery_progress** - keyword, text.text

* *md_devices.recovery_progress* - Progress of the recovery activity

**recovery_speed** - keyword, text.text

* *md_devices.recovery_speed* - Speed of recovery activity

**redirect_accept** - keyword, number.long

* *interface_ipv6.redirect_accept* - Accept ICMP redirect messages

**ref_pid** - keyword, number.long

* *asl.ref_pid* - Reference PID for messages proxied by launchd

**ref_proc** - keyword, text.text

* *asl.ref_proc* - Reference process for messages proxied by launchd

**referenced** - keyword, number.long

* *chrome_extension_content_scripts.referenced* - 1 if this extension is referenced by the Preferences file of the profile
* *chrome_extensions.referenced* - 1 if this extension is referenced by the Preferences file of the profile

**referenced_identifier** - keyword, text.text

* *chrome_extensions.referenced_identifier* - Extension identifier, as specified by the preferences file. Empty if the extension is not in the profile.

**refreshes** - keyword, number.long

* *osquery_events.refreshes* - Publisher only: number of runloop restarts

**refs** - keyword, number.long

* *kernel_extensions.refs* - Reference count

**region** - keyword, text.text

* *ec2_instance_metadata.region* - AWS region in which this instance launched

**registers** - keyword, text.text

* *crashes.registers* - The value of the system registers
* *kernel_panics.registers* - A space delimited line of register:value pairs
* *windows_crashes.registers* - The values of the system registers

**registry** - keyword, text.text

* *osquery_registry.registry* - Name of the osquery registry

**registry_hive** - keyword, text.text

* *logged_in_users.registry_hive* - HKEY_USERS registry hive

**registry_path** - keyword, text.text

* *ie_extensions.registry_path* - Extension identifier

**relative_path** - keyword, text.text

* *wmi_cli_event_consumers.relative_path* - Relative path to the class or instance.
* *wmi_event_filters.relative_path* - Relative path to the class or instance.
* *wmi_filter_consumer_binding.relative_path* - Relative path to the class or instance.
* *wmi_script_event_consumers.relative_path* - Relative path to the class or instance.

**release** - keyword, text.text

* *apt_sources.release* - Release name
* *lxd_images.release* - OS release version on which the image is based
* *rpm_packages.release* - Package release

**remediation_path** - keyword, text.text

* *windows_security_products.remediation_path* - Remediation path

**remote_address** - keyword, text.text

* *bpf_socket_events.remote_address* - Remote address associated with socket
* *process_open_sockets.remote_address* - Socket remote address
* *socket_events.remote_address* - Remote address associated with socket

**remote_addresses** - keyword, text.text

* *windows_firewall_rules.remote_addresses* - Remote addresses for the rule

**remote_apple_events** - keyword, number.long

* *sharing_preferences.remote_apple_events* - 1 If remote apple events are enabled else 0

**remote_login** - keyword, number.long

* *sharing_preferences.remote_login* - 1 If remote login is enabled else 0

**remote_management** - keyword, number.long

* *sharing_preferences.remote_management* - 1 If remote management is enabled else 0

**remote_port** - keyword, number.long

* *bpf_socket_events.remote_port* - Remote network protocol port number
* *process_open_sockets.remote_port* - Socket remote port
* *socket_events.remote_port* - Remote network protocol port number

**remote_ports** - keyword, text.text

* *windows_firewall_rules.remote_ports* - Remote ports for the rule

**removable** - keyword, number.long

* *usb_devices.removable* - 1 If USB device is removable else 0

**repository** - keyword, text.text

* *portage_packages.repository* - From which repository the ebuild was used

**request_id** - keyword, text.text

* *carves.request_id* - Identifying value of the carve request (e.g., scheduled query name, distributed request, etc)

**requested_mask** - keyword, text.text

* *apparmor_events.requested_mask* - Requested access mask

**requirement** - keyword, text.text

* *gatekeeper_approved_apps.requirement* - Code signing requirement language

**reservation_id** - keyword, text.text

* *ec2_instance_metadata.reservation_id* - ID of the reservation

**reshape_finish** - keyword, text.text

* *md_devices.reshape_finish* - Estimated duration of reshape activity

**reshape_progress** - keyword, text.text

* *md_devices.reshape_progress* - Progress of the reshape activity

**reshape_speed** - keyword, text.text

* *md_devices.reshape_speed* - Speed of reshape activity

**resident_size** - keyword, number.long

* *docker_container_processes.resident_size* - Bytes of private memory used by process
* *processes.resident_size* - Bytes of private memory used by process

**resolution** - keyword, text.text

* *connected_displays.resolution* - The resolution of the display.

**resource_group_name** - keyword, text.text

* *azure_instance_metadata.resource_group_name* - Resource group for the VM

**response_code** - keyword, number.long

* *curl.response_code* - The HTTP status code for the response

**responsible** - keyword, text.text

* *crashes.responsible* - Process responsible for the crashed process

**result** - keyword, text.text

* *authenticode.result* - The signature check result
* *curl.result* - The HTTP response body

**result_code** - keyword, text.text

* *windows_update_history.result_code* - Result of an operation on an update

**resync_finish** - keyword, text.text

* *md_devices.resync_finish* - Estimated duration of resync activity

**resync_progress** - keyword, text.text

* *md_devices.resync_progress* - Progress of the resync activity

**resync_speed** - keyword, text.text

* *md_devices.resync_speed* - Speed of resync activity

**retain_count** - keyword, number.long

* *iokit_devicetree.retain_count* - The device reference count
* *iokit_registry.retain_count* - The node reference count

**revision** - keyword, text.text

* *deb_packages.revision* - Package revision
* *hardware_events.revision* - Device revision (optional)
* *os_version.revision* - Update Build Revision, refers to the specific revision number of a Windows update
* *platform_info.revision* - BIOS major and minor revision

**roaming** - keyword, number.long

* *wifi_networks.roaming* - 1 if roaming is supported, 0 otherwise

**roaming_profile** - keyword, text.text

* *wifi_networks.roaming_profile* - Describe the roaming profile, usually one of Single, Dual  or Multi

**root** - keyword, text.text

* *processes.root* - Process virtual root directory

**root_dir** - keyword, text.text

* *docker_info.root_dir* - Docker root directory

**root_directory** - keyword, text.text

* *launchd.root_directory* - Key used to specify a directory to chroot to before launch

**root_volume_uuid** - keyword, text.text

* *time_machine_destinations.root_volume_uuid* - Root UUID of backup volume

**rotation** - keyword, text.text

* *connected_displays.rotation* - The orientation of the display.

**round_trip_time** - keyword, number.long

* *curl.round_trip_time* - Time taken to complete the request

**rowid** - keyword, number.long

* *quicklook_cache.rowid* - Quicklook file rowid key

**rssi** - keyword, number.long

* *wifi_status.rssi* - The current received signal strength indication (dbm)
* *wifi_survey.rssi* - The current received signal strength indication (dbm)

**rtadv_accept** - keyword, number.long

* *interface_ipv6.rtadv_accept* - Accept ICMP Router Advertisement

**rule_details** - keyword, text.text

* *sudoers.rule_details* - Rule definition

**run_at_load** - keyword, text.text

* *launchd.run_at_load* - Should the program run on launch load

**run_count** - keyword, number.long

* *prefetch.run_count* - Number of times the application has been run.

**rw** - keyword, number.long

* *docker_container_mounts.rw* - 1 if read/write. 0 otherwise

**scheme** - keyword, text.text

* *app_schemes.scheme* - Name of the scheme/protocol

**scope** - keyword, text.text

* *selinux_settings.scope* - Where the key is located inside the SELinuxFS mount point.

**screen_sharing** - keyword, number.long

* *sharing_preferences.screen_sharing* - 1 If screen sharing is enabled else 0

**script** - keyword, text.text

* *chrome_extension_content_scripts.script* - The content script used by the extension

**script_block_count** - keyword, number.long

* *powershell_events.script_block_count* - The total number of script blocks for this script

**script_block_id** - keyword, text.text

* *powershell_events.script_block_id* - The unique GUID of the powershell script to which this block belongs

**script_file_name** - keyword, text.text

* *wmi_script_event_consumers.script_file_name* - Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.

**script_name** - keyword, text.text

* *powershell_events.script_name* - The name of the Powershell script

**script_path** - keyword, text.text

* *powershell_events.script_path* - The path for the Powershell script

**script_text** - keyword, text.text

* *powershell_events.script_text* - The text content of the Powershell script
* *wmi_script_event_consumers.script_text* - Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.

**scripting_engine** - keyword, text.text

* *wmi_script_event_consumers.scripting_engine* - Name of the scripting engine to use, for example, *VBScript*. This property cannot be NULL.

**sdb_id** - keyword, text.text

* *appcompat_shims.sdb_id* - Unique GUID of the SDB.

**sdk** - keyword, text.text

* *browser_plugins.sdk* - Build SDK used to compile plugin
* *safari_extensions.sdk* - Bundle SDK used to compile extension

**sdk_version** - keyword, text.text

* *osquery_extensions.sdk_version* - osquery SDK version used to build the extension

**seconds** - keyword, number.long

* *time.seconds* - Current seconds in UTC
* *uptime.seconds* - Seconds of uptime

**section** - keyword, text.text

* *deb_packages.section* - Package section

**secure_boot** - keyword, number.long

* *secureboot.secure_boot* - Whether secure boot is enabled

**secure_mode** - keyword, number.long

* *secureboot.secure_mode* - (Intel) Secure mode: 0 disabled, 1 full security, 2 medium security

**secure_process** - keyword, number.long

* *processes.secure_process* - Process is secure (IUM) yes=1, no=0

**security_breach** - keyword, text.text

* *chassis_info.security_breach* - The physical status of the chassis such as Breach Successful, Breach Attempted, etc.

**security_groups** - keyword, text.text

* *ec2_instance_metadata.security_groups* - Comma separated list of security group names

**security_options** - keyword, text.text

* *docker_containers.security_options* - List of container security options

**security_type** - keyword, text.text

* *wifi_networks.security_type* - Type of security on this network
* *wifi_status.security_type* - Type of security on this network

**self_signed** - keyword, number.long

* *certificates.self_signed* - 1 if self-signed, else 0

**sender** - keyword, text.text

* *asl.sender* - Sender’s identification string.  Default is process name.
* *unified_log.sender* - the name of the binary image that made the entry

**sensor_backend_server** - keyword, text.text

* *carbon_black_info.sensor_backend_server* - Carbon Black server

**sensor_id** - keyword, number.long

* *carbon_black_info.sensor_id* - Sensor ID of the Carbon Black sensor

**sensor_ip_addr** - keyword, text.text

* *carbon_black_info.sensor_ip_addr* - IP address of the sensor

**seq_num** - keyword, number.long

* *es_process_events.seq_num* - Per event sequence number
* *es_process_file_events.seq_num* - Per event sequence number

**serial** - keyword, text.text

* *certificates.serial* - Certificate serial number
* *chassis_info.serial* - The serial number of the chassis.
* *disk_info.serial* - The serial number of the disk.
* *hardware_events.serial* - Device serial (optional)
* *usb_devices.serial* - USB Device serial connection

**serial_number** - keyword, text.text

* *authenticode.serial_number* - The certificate serial number
* *battery.serial_number* - The battery’s serial number
* *connected_displays.serial_number* - The serial number of the display. (may not be unique)
* *curl_certificate.serial_number* - Certificate serial number
* *kernel_keys.serial_number* - The serial key of the key.
* *memory_devices.serial_number* - Serial number of memory device

**serial_port_enabled** - keyword, text.text

* *ycloud_instance_metadata.serial_port_enabled* - Indicates if serial port is enabled for the VM

**series** - keyword, text.text

* *video_info.series* - The series of the gpu.

**server_name** - keyword, text.text

* *lxd_cluster.server_name* - Name of the LXD server node
* *lxd_cluster_members.server_name* - Name of the LXD server node

**server_selection** - keyword, text.text

* *windows_update_history.server_selection* - Value that indicates which server provided an update

**server_version** - keyword, text.text

* *docker_info.server_version* - Server version

**service** - keyword, text.text

* *drivers.service* - Driver service name, if one exists
* *interface_details.service* - The name of the service the network adapter uses.
* *iokit_devicetree.service* - 1 if the device conforms to IOService else 0

**service_exit_code** - keyword, number.long

* *services.service_exit_code* - The service-specific error code that the service returns when an error occurs while the service is starting or stopping

**service_id** - keyword, text.text

* *windows_update_history.service_id* - Service identifier of an update service that is not a Windows update

**service_key** - keyword, text.text

* *drivers.service_key* - Driver service registry key

**service_name** - keyword, text.text

* *windows_firewall_rules.service_name* - Service name property of the application

**service_type** - keyword, text.text

* *services.service_type* - Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)

**ses** - keyword, number.long

* *seccomp_events.ses* - Session ID of the session from which the analyzed process was invoked

**session_id** - keyword, number.long

* *logon_sessions.session_id* - The Terminal Services session identifier.
* *process_etw_events.session_id* - Session ID
* *winbaseobj.session_id* - Terminal Services Session Id

**session_owner** - keyword, text.text

* *authorizations.session_owner* - Label top-level key

**set** - keyword, number.long

* *memory_devices.set* - Identifies if memory device is one of a set of devices.  A value of 0 indicates no set affiliation.

**setup_mode** - keyword, number.long

* *secureboot.setup_mode* - Whether setup mode is enabled

**severity** - keyword, number.long

* *syslog_events.severity* - Syslog severity

**sgid** - keyword

* *docker_container_processes.sgid* - Saved group ID
* *process_events.sgid* - Saved group ID at process start
* *process_file_events.sgid* - Saved group ID of the process using the file
* *processes.sgid* - Unsigned saved group ID

**sha1** - keyword, text.text

* *apparmor_profiles.sha1* - A unique hash that identifies this policy.
* *certificates.sha1* - SHA1 hash of the raw certificate contents
* *device_hash.sha1* - SHA1 hash of provided inode data
* *file_events.sha1* - The SHA1 of the file after change
* *hash.sha1* - SHA1 hash of provided filesystem data
* *rpm_packages.sha1* - SHA1 hash of the package contents

**sha1_fingerprint** - keyword, text.text

* *curl_certificate.sha1_fingerprint* - SHA1 fingerprint

**sha256** - keyword, text.text

* *apparmor_profiles.sha256* - A unique hash that identifies this policy.
* *carves.sha256* - A SHA256 sum of the carved archive
* *device_hash.sha256* - SHA256 hash of provided inode data
* *file_events.sha256* - The SHA256 of the file after change
* *hash.sha256* - SHA256 hash of provided filesystem data
* *rpm_package_files.sha256* - SHA256 file digest from RPM info DB

**sha256_fingerprint** - keyword, text.text

* *curl_certificate.sha256_fingerprint* - SHA-256 fingerprint

**shard** - keyword, number.long

* *osquery_packs.shard* - Shard restriction limit, 1-100, 0 meaning no restriction

**share** - keyword, text.text

* *nfs_shares.share* - Filesystem path to the share

**shared** - keyword, text.text

* *authorizations.shared* - Label top-level key

**shell** - keyword, text.text

* *users.shell* - User’s configured default shell

**shell_only** - keyword, number.long

* *osquery_flags.shell_only* - Is the flag shell only?

**shmid** - keyword, number.long

* *shared_memory.shmid* - Shared memory segment ID

**shortcut_comment** - keyword, text.text

* *file.shortcut_comment* - Comment on the shortcut

**shortcut_run** - keyword, text.text

* *file.shortcut_run* - Window mode the target of the shortcut should be run in

**shortcut_start_in** - keyword, text.text

* *file.shortcut_start_in* - Full path to the working directory to use when executing the shortcut target

**shortcut_target_location** - keyword, text.text

* *file.shortcut_target_location* - Folder name where the shortcut target resides

**shortcut_target_path** - keyword, text.text

* *file.shortcut_target_path* - Full path to the file the shortcut points to

**shortcut_target_type** - keyword, text.text

* *file.shortcut_target_type* - Display name for the target type

**sid** - keyword, text.text

* *background_activities_moderator.sid* - User SID.
* *certificates.sid* - SID
* *logged_in_users.sid* - The user’s unique security identifier
* *office_mru.sid* - User SID
* *shellbags.sid* - User SID
* *userassist.sid* - User SID.

**sig** - keyword, number.long

* *seccomp_events.sig* - Signal value sent to process by seccomp

**sig_group** - keyword, text.text

* *yara.sig_group* - Signature group used

**sigfile** - keyword, text.text

* *yara.sigfile* - Signature file used

**signature** - keyword, text.text

* *curl_certificate.signature* - Signature

**signature_algorithm** - keyword, text.text

* *curl_certificate.signature_algorithm* - Signature Algorithm

**signatures_up_to_date** - keyword, number.long

* *windows_security_products.signatures_up_to_date* - 1 if product signatures are up to date, else 0

**signed** - keyword, number.long

* *drivers.signed* - Whether the driver is signed or not
* *signature.signed* - 1 If the file is signed else 0

**signing_algorithm** - keyword, text.text

* *certificates.signing_algorithm* - Signing algorithm used

**signing_id** - keyword, text.text

* *es_process_events.signing_id* - Signature identifier of the process

**sigrule** - keyword, text.text

* *yara.sigrule* - Signature strings used

**sigurl** - keyword, text.text

* *yara.sigurl* - Signature url

**size** - keyword

* *acpi_tables.size* - Size of compiled table data
* *block_devices.size* - Block device size in blocks
* *carves.size* - Size of the carved archive
* *cups_jobs.size* - The size of the print job
* *deb_packages.size* - Package size in bytes
* *device_file.size* - Size of file in bytes
* *disk_events.size* - Size of partition in bytes
* *docker_image_history.size* - Size of instruction in bytes
* *file.size* - Size of file in bytes
* *file_events.size* - Size of file in bytes
* *kernel_extensions.size* - Bytes of wired memory used by extension
* *kernel_modules.size* - Size of module content
* *logical_drives.size* - The total amount of space, in bytes, of the drive (-1 on failure).
* *lxd_images.size* - Size of image in bytes
* *lxd_storage_pools.size* - Size of the storage pool
* *md_devices.size* - size of the array in blocks
* *memory_devices.size* - Size of memory device in Megabyte
* *package_bom.size* - Expected file size
* *platform_info.size* - Size in bytes of firmware
* *portage_packages.size* - The size of the package
* *prefetch.size* - Application file size.
* *quicklook_cache.size* - Parsed version size field
* *rpm_package_files.size* - Expected file size in bytes from RPM info DB
* *rpm_packages.size* - Package size in bytes
* *shared_memory.size* - Size in bytes
* *smbios_tables.size* - Table entry size in bytes
* *smc_keys.size* - Reported size of data in bytes
* *windows_search.size* - The item size in bytes.

**size_bytes** - keyword, number.long

* *docker_images.size_bytes* - Size of image in bytes

**sku** - keyword, text.text

* *azure_instance_metadata.sku* - SKU for the VM image
* *chassis_info.sku* - The Stock Keeping Unit number if available.

**slot** - keyword

* *md_drives.slot* - Slot position of disk
* *portage_packages.slot* - The slot used by package

**smbios_tag** - keyword, text.text

* *chassis_info.smbios_tag* - The assigned asset tag number of the chassis.

**socket** - keyword

* *listening_ports.socket* - Socket handle or inode number
* *process_open_sockets.socket* - Socket handle or inode number
* *socket_events.socket* - The local path (UNIX domain socket only)

**socket_designation** - keyword, text.text

* *cpu_info.socket_designation* - The assigned socket on the board for the given CPU.

**soft_limit** - keyword, text.text

* *ulimit_info.soft_limit* - Current limit value

**softirq** - keyword, number.long

* *cpu_time.softirq* - Time spent servicing softirqs

**sort** - keyword, text.text

* *windows_search.sort* - Sort for windows api

**source** - keyword, text.text

* *apt_sources.source* - Source file
* *autoexec.source* - Source table of the autoexec item
* *deb_packages.source* - Package source
* *docker_container_mounts.source* - Source path on host
* *lxd_storage_pools.source* - Storage pool source
* *package_install_history.source* - Install source: usually the installer process name
* *routes.source* - Route source
* *rpm_packages.source* - Source RPM package name (optional)
* *shellbags.source* - Shellbags source Registry file
* *startup_items.source* - Directory or plist containing startup item
* *sudoers.source* - Source file containing the given rule
* *windows_events.source* - Source or channel of the event
* *yum_sources.source* - Source file

**source_path** - keyword, text.text

* *systemd_units.source_path* - Path to the (possibly generated) unit configuration file

**source_url** - keyword, text.text

* *firefox_addons.source_url* - URL that installed the addon

**space_total** - keyword, number.long

* *lxd_storage_pools.space_total* - Total available storage space in bytes for this storage pool

**space_used** - keyword, number.long

* *lxd_storage_pools.space_used* - Storage space used in bytes

**spare_disks** - keyword, number.long

* *md_devices.spare_disks* - Number of idle disks in array

**spec_version** - keyword, text.text

* *tpm_info.spec_version* - Trusted Computing Group specification that the TPM supports

**speculative** - keyword, number.long

* *virtual_memory_info.speculative* - Total number of speculative pages.

**speed** - keyword, number.long

* *interface_details.speed* - Estimate of the current bandwidth in bits per second.

**src_ip** - keyword, text.text

* *iptables.src_ip* - Source IP address.

**src_mask** - keyword, text.text

* *iptables.src_mask* - Source IP address mask.

**src_port** - keyword, text.text

* *iptables.src_port* - Protocol source port(s).

**ssh_config_file** - keyword, text.text

* *ssh_configs.ssh_config_file* - Path to the ssh_config file

**ssh_public_key** - keyword, text.text

* *ec2_instance_metadata.ssh_public_key* - SSH public key. Only available if supplied at instance launch time
* *ycloud_instance_metadata.ssh_public_key* - SSH public key. Only available if supplied at instance launch time

**ssid** - keyword, text.text

* *wifi_networks.ssid* - SSID octets of the network
* *wifi_status.ssid* - SSID octets of the network
* *wifi_survey.ssid* - SSID octets of the network

**stack_trace** - keyword, text.text

* *crashes.stack_trace* - Most recent frame from the stack trace
* *windows_crashes.stack_trace* - Multiple stack frames from the stack trace

**start** - keyword, text.text

* *memory_map.start* - Start address of memory region
* *process_memory_map.start* - Virtual start address (hex)

**start_interval** - keyword, text.text

* *launchd.start_interval* - Frequency to run in seconds

**start_on_mount** - keyword, text.text

* *launchd.start_on_mount* - Run daemon or agent every time a filesystem is mounted

**start_time** - keyword, number.long

* *docker_container_processes.start_time* - Process start in seconds since boot (non-sleeping)
* *osquery_info.start_time* - UNIX time in seconds when the process started
* *processes.start_time* - Process start time in seconds since Epoch, in case of error -1

**start_type** - keyword, text.text

* *services.start_type* - Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED

**started_at** - keyword, text.text

* *docker_containers.started_at* - Container start time as string

**starting_address** - keyword, text.text

* *memory_array_mapped_addresses.starting_address* - Physical stating address, in kilobytes, of a range of memory mapped to physical memory array
* *memory_device_mapped_addresses.starting_address* - Physical stating address, in kilobytes, of a range of memory mapped to physical memory array

**state** - keyword

* *alf_exceptions.state* - Firewall exception state
* *battery.state* - One of the following: "AC Power" indicates the battery is connected to an external power source, "Battery Power" indicates that the battery is drawing internal power, "Off Line" indicates the battery is off-line or no longer connected
* *chrome_extensions.state* - 1 if this extension is enabled
* *docker_container_processes.state* - Process state
* *docker_containers.state* - Container state (created, restarting, running, removing, paused, exited, dead)
* *lxd_networks.state* - Network status
* *md_drives.state* - State of the drive
* *process_open_sockets.state* - TCP socket state
* *processes.state* - Process state
* *scheduled_tasks.state* - State of the scheduled task
* *system_extensions.state* - System extension state
* *windows_optional_features.state* - Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent
* *windows_security_products.state* - State of protection

**state_timestamp** - keyword, text.text

* *windows_security_products.state_timestamp* - Timestamp for the product state

**stateful** - keyword, number.long

* *lxd_instances.stateful* - Whether the instance is stateful(1) or not(0)

**statename** - keyword, text.text

* *windows_optional_features.statename* - Installation state name. *Enabled*,*Disabled*,*Absent*

**status** - keyword, text.text

* *carves.status* - Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED
* *chassis_info.status* - If available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail.
* *deb_packages.status* - Package status
* *docker_containers.status* - Container status information
* *kernel_modules.status* - Kernel module status
* *lxd_cluster_members.status* - Status of the node (Online/Offline)
* *lxd_instances.status* - Instance state (running, stopped, etc.)
* *md_devices.status* - Current state of the array
* *ntdomains.status* - The current status of the domain object.
* *process_events.status* - OpenBSM Attribute: Status of the process
* *services.status* - Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED
* *shared_memory.status* - Destination/attach status
* *shared_resources.status* - String that indicates the current status of the object.
* *socket_events.status* - Either *succeeded*, *failed*, *in_progress* (connect() on non-blocking socket) or *no_client* (null accept() on non-blocking socket)
* *startup_items.status* - Startup status; either enabled or disabled

**stderr_path** - keyword, text.text

* *launchd.stderr_path* - Pipe stderr to a target path

**stdout_path** - keyword, text.text

* *launchd.stdout_path* - Pipe stdout to a target path

**steal** - keyword, number.long

* *cpu_time.steal* - Time spent in other operating systems when running in a virtualized environment

**stealth_enabled** - keyword, number.long

* *alf.stealth_enabled* - 1 If stealth mode is enabled else 0

**stibp_support_enabled** - keyword, number.long

* *kva_speculative_info.stibp_support_enabled* - Windows uses STIBP.

**storage** - keyword, number.long

* *unified_log.storage* - the storage category for the entry

**storage_driver** - keyword, text.text

* *docker_info.storage_driver* - Storage driver

**store** - keyword, text.text

* *certificates.store* - Certificate system store

**store_id** - keyword, text.text

* *certificates.store_id* - Exists for service/user stores. Contains raw store id provided by WinAPI.

**store_location** - keyword, text.text

* *certificates.store_location* - Certificate system store location

**strings** - keyword, text.text

* *yara.strings* - Matching strings
* *yara_events.strings* - Matching strings

**sub_state** - keyword, text.text

* *systemd_units.sub_state* - The low-level unit activation state, values depend on unit type

**subclass** - keyword, text.text

* *usb_devices.subclass* - USB Device subclass

**subject** - keyword, text.text

* *certificates.subject* - Certificate distinguished name (deprecated, use subject2)

**subject2** - keyword, text.text

* *certificates.subject2* - Certificate distinguished name

**subject_alternative_names** - keyword, text.text

* *curl_certificate.subject_alternative_names* - Subject Alternative Name

**subject_info_access** - keyword, text.text

* *curl_certificate.subject_info_access* - Subject Information Access

**subject_key_id** - keyword, text.text

* *certificates.subject_key_id* - SKID an optionally included SHA1

**subject_key_identifier** - keyword, text.text

* *curl_certificate.subject_key_identifier* - Subject Key Identifier

**subject_name** - keyword, text.text

* *authenticode.subject_name* - The certificate subject name

**subkey** - keyword, text.text

* *plist.subkey* - Intermediate key path, includes lists/dicts
* *preferences.subkey* - Intemediate key path, includes lists/dicts

**subnet** - keyword, text.text

* *docker_networks.subnet* - Network subnet

**subscription_id** - keyword, text.text

* *azure_instance_metadata.subscription_id* - Azure subscription for the VM

**subscriptions** - keyword, number.long

* *osquery_events.subscriptions* - Number of subscriptions the publisher received or subscriber used

**subsystem** - keyword, text.text

* *system_controls.subsystem* - Subsystem ID, control type
* *unified_log.subsystem* - the subsystem of the os_log_t used

**subsystem_model** - keyword, text.text

* *pci_devices.subsystem_model* - Device description of PCI device subsystem

**subsystem_model_id** - keyword, text.text

* *pci_devices.subsystem_model_id* - Model ID of PCI device subsystem

**subsystem_vendor** - keyword, text.text

* *pci_devices.subsystem_vendor* - Vendor of PCI device subsystem

**subsystem_vendor_id** - keyword, text.text

* *pci_devices.subsystem_vendor_id* - Vendor ID of PCI device subsystem

**success** - keyword, number.long

* *socket_events.success* - Deprecated. Use the *status* column instead

**suid** - keyword

* *docker_container_processes.suid* - Saved user ID
* *process_events.suid* - Saved user ID at process start
* *process_file_events.suid* - Saved user ID of the process using the file
* *processes.suid* - Unsigned saved user ID

**summary** - keyword, text.text

* *chocolatey_packages.summary* - Package-supplied summary
* *python_packages.summary* - Package-supplied summary

**superblock_state** - keyword, text.text

* *md_devices.superblock_state* - State of the superblock

**superblock_update_time** - keyword, number.long

* *md_devices.superblock_update_time* - Unix timestamp of last update

**superblock_version** - keyword, text.text

* *md_devices.superblock_version* - Version of the superblock

**support_url** - keyword, text.text

* *windows_update_history.support_url* - Hyperlink to the language-specific support information for an update

**swap_cached** - keyword, number.long

* *memory_info.swap_cached* - The amount of swap, in bytes, used as cache memory

**swap_free** - keyword, number.long

* *memory_info.swap_free* - The total amount of swap free, in bytes

**swap_ins** - keyword, number.long

* *virtual_memory_info.swap_ins* - The total number of compressed pages that have been swapped out to disk.

**swap_limit** - keyword, number.long

* *docker_info.swap_limit* - 1 if swap limit support is enabled. 0 otherwise

**swap_outs** - keyword, number.long

* *virtual_memory_info.swap_outs* - The total number of compressed pages that have been swapped back in from disk.

**swap_total** - keyword, number.long

* *memory_info.swap_total* - The total amount of swap available, in bytes

**symlink** - keyword, number.long

* *file.symlink* - 1 if the path is a symlink, otherwise 0

**syscall** - keyword, text.text

* *bpf_process_events.syscall* - System call name
* *bpf_socket_events.syscall* - System call name
* *process_events.syscall* - Syscall name: fork, vfork, clone, execve, execveat
* *seccomp_events.syscall* - Type of the system call

**system** - keyword, number.long

* *cpu_time.system* - Time spent in system mode

**system_cpu_usage** - keyword, number.long

* *docker_container_stats.system_cpu_usage* - CPU system usage

**system_model** - keyword, text.text

* *kernel_panics.system_model* - Physical system model, for example *MacBookPro12,1 (Mac-E43C1C25D4880AD6)*

**system_time** - keyword, number.long

* *osquery_schedule.system_time* - Total system time in milliseconds spent executing
* *processes.system_time* - CPU time in milliseconds spent in kernel space

**tag** - keyword, text.text

* *syslog_events.tag* - The syslog tag

**tags** - keyword, text.text

* *docker_image_history.tags* - Comma-separated list of tags
* *docker_images.tags* - Comma-separated list of repository tags
* *yara.tags* - Matching tags
* *yara_events.tags* - Matching tags

**tapping_process** - keyword, number.long

* *event_taps.tapping_process* - The process ID of the application that created the event tap.

**target** - keyword

* *fan_speed_sensors.target* - Target speed
* *iptables.target* - Target that applies for this rule.

**target_name** - keyword, text.text

* *prometheus_metrics.target_name* - Address of prometheus target

**target_path** - keyword, text.text

* *file_events.target_path* - The path associated with the event
* *yara_events.target_path* - The path scanned

**task** - keyword, number.long

* *windows_eventlog.task* - Task value associated with the event
* *windows_events.task* - Task value associated with the event

**team** - keyword, text.text

* *system_extensions.team* - Signing team ID

**team_id** - keyword, text.text

* *es_process_events.team_id* - Team identifier of the process

**team_identifier** - keyword, text.text

* *signature.team_identifier* - The team signing identifier sealed into the signature

**temporarily_disabled** - keyword, number.long

* *wifi_networks.temporarily_disabled* - 1 if this network is temporarily disabled, 0 otherwise

**terminal** - keyword, text.text

* *user_events.terminal* - The network protocol ID

**threads** - keyword, number.long

* *docker_container_processes.threads* - Number of threads used by process
* *processes.threads* - Number of threads used by process

**throttled** - keyword, number.long

* *virtual_memory_info.throttled* - Total number of throttled pages.

**tid** - keyword, number.long

* *bpf_process_events.tid* - Thread ID
* *bpf_socket_events.tid* - Thread ID
* *unified_log.tid* - the tid of the thread that made the entry
* *windows_crashes.tid* - Thread ID of the crashed thread
* *windows_eventlog.tid* - Thread ID which emitted the event record

**time** - keyword

* *apparmor_events.time* - Time of execution in UNIX time
* *asl.time* - Unix timestamp.  Set automatically
* *bpf_process_events.time* - Time of execution in UNIX time
* *bpf_socket_events.time* - Time of execution in UNIX time
* *carves.time* - Time at which the carve was kicked off
* *disk_events.time* - Time of appearance/disappearance in UNIX time
* *docker_container_processes.time* - Cumulative CPU time. [DD-]HH:MM:SS format
* *es_process_events.time* - Time of execution in UNIX time
* *es_process_file_events.time* - Time of execution in UNIX time
* *file_events.time* - Time of file event
* *hardware_events.time* - Time of hardware event
* *kernel_panics.time* - Formatted time of the event
* *last.time* - Entry timestamp
* *logged_in_users.time* - Time entry was made
* *ntfs_journal_events.time* - Time of file event
* *package_install_history.time* - Label date as UNIX timestamp
* *powershell_events.time* - Timestamp the event was received by the osquery event publisher
* *process_etw_events.time* - Event timestamp in Unix format
* *process_events.time* - Time of execution in UNIX time
* *process_file_events.time* - Time of execution in UNIX time
* *seccomp_events.time* - Time of execution in UNIX time
* *selinux_events.time* - Time of execution in UNIX time
* *shell_history.time* - Entry timestamp. It could be absent, default value is 0.
* *socket_events.time* - Time of execution in UNIX time
* *syslog_events.time* - Current unix epoch time
* *user_events.time* - Time of execution in UNIX time
* *user_interaction_events.time* - Time
* *windows_events.time* - Timestamp the event was received
* *xprotect_reports.time* - Quarantine alert time
* *yara_events.time* - Time of the scan

**time_nano_sec** - keyword, number.long

* *asl.time_nano_sec* - Nanosecond time.

**time_range** - keyword, text.text

* *windows_eventlog.time_range* - System time to selectively filter the events

**time_windows** - keyword, number.long

* *process_etw_events.time_windows* - Event timestamp in Windows format

**timeout** - keyword, text.text

* *authorizations.timeout* - Label top-level key
* *curl_certificate.timeout* - Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout)
* *kernel_keys.timeout* - The amount of time until the key will expire, expressed in human-readable form. The string perm here means that the key is permanent (no timeout).  The string expd means that the key has already expired.

**timestamp** - keyword, text.text

* *time.timestamp* - Current timestamp (log format) in UTC
* *unified_log.timestamp* - unix timestamp associated with the entry
* *windows_eventlog.timestamp* - Timestamp to selectively filter the events

**timestamp_ms** - keyword, number.long

* *prometheus_metrics.timestamp_ms* - Unix timestamp of collected data in MS

**timezone** - keyword, text.text

* *time.timezone* - Timezone for reported time (hardcoded to UTC)

**title** - keyword, text.text

* *cups_jobs.title* - Title of the printed job
* *windows_update_history.title* - Title of an update

**token_elevation_status** - keyword, number.long

* *process_etw_events.token_elevation_status* - Primary token elevation status - Present only on ProcessStart events

**token_elevation_type** - keyword, text.text

* *process_etw_events.token_elevation_type* - Primary token elevation type - Present only on ProcessStart events

**total_seconds** - keyword, number.long

* *uptime.total_seconds* - Total uptime seconds

**total_size** - keyword, number.long

* *docker_container_processes.total_size* - Total virtual memory size
* *processes.total_size* - Total virtual memory size (Linux, Windows) or *footprint* (macOS)

**total_width** - keyword, number.long

* *memory_devices.total_width* - Total width, in bits, of this memory device, including any check or error-correction bits

**transaction_id** - keyword, number.long

* *file_events.transaction_id* - ID used during bulk update
* *yara_events.transaction_id* - ID used during bulk update

**translated** - keyword, number.long

* *processes.translated* - Indicates whether the process is running under the Rosetta Translation Environment, yes=1, no=0, error=-1.

**transmit_rate** - keyword, text.text

* *wifi_status.transmit_rate* - The current transmit rate

**tries** - keyword, text.text

* *authorizations.tries* - Label top-level key

**tty** - keyword, text.text

* *last.tty* - Entry terminal
* *logged_in_users.tty* - Device name

**turbo_disabled** - keyword, number.long

* *msr.turbo_disabled* - Whether the turbo feature is disabled.

**turbo_ratio_limit** - keyword, number.long

* *msr.turbo_ratio_limit* - The turbo feature ratio limit.

**type** - keyword, text.text

* *apparmor_events.type* - Event type
* *appcompat_shims.type* - Type of the SDB database.
* *block_devices.type* - Block device type string
* *bpf_socket_events.type* - The socket type
* *crashes.type* - Type of crash log
* *device_file.type* - File status
* *device_firmware.type* - Type of device
* *device_partitions.type* - Filesystem type if recognized, otherwise, *meta*, *normal*, or *unallocated*
* *disk_encryption.type* - Description of cipher type and mode if available
* *disk_info.type* - The interface type of the disk.
* *dns_cache.type* - DNS record type
* *dns_resolvers.type* - Address type: sortlist, nameserver, search
* *docker_container_mounts.type* - Type of mount (bind, volume)
* *docker_container_ports.type* - Protocol (tcp, udp)
* *docker_volumes.type* - Volume type
* *file.type* - File status
* *firefox_addons.type* - Extension, addon, webapp
* *hardware_events.type* - Type of hardware and hardware event
* *homebrew_packages.type* - Package type (*formula* or *cask*)
* *interface_addresses.type* - Type of address. One of dhcp, manual, auto, other, unknown
* *interface_details.type* - Interface type (includes virtual)
* *kernel_keys.type* - The key type.
* *keychain_items.type* - Keychain item type (class)
* *last.type* - Entry type, according to ut_type types (utmp.h)
* *logged_in_users.type* - Login type
* *logical_drives.type* - Deprecated (always *Unknown*).
* *lxd_certificates.type* - Type of the certificate
* *lxd_networks.type* - Type of network
* *mounts.type* - Mounted device type
* *ntfs_acl_permissions.type* - Type of access mode for the access control entry.
* *nvram.type* - Data type (CFData, CFString, etc)
* *osquery_events.type* - Either publisher or subscriber
* *osquery_extensions.type* - SDK extension type: core, extension, or module
* *osquery_flags.type* - Flag type
* *process_etw_events.type* - Event Type (ProcessStart, ProcessStop)
* *process_open_pipes.type* - Pipe Type: named vs unnamed/anonymous
* *registry.type* - Type of the registry value, or *subkey* if item is a subkey
* *routes.type* - Type of route
* *selinux_events.type* - Event type
* *shared_resources.type* - Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.
* *smbios_tables.type* - Table entry type
* *smc_keys.type* - SMC-reported type literal type
* *startup_items.type* - Startup Item or Login Item
* *system_controls.type* - Data type
* *ulimit_info.type* - System resource to be limited
* *user_events.type* - The file description for the process socket
* *users.type* - Whether the account is roaming (domain), local, or a system profile
* *windows_crashes.type* - Type of crash log
* *windows_search.type* - The item type
* *windows_security_products.type* - Type of security product
* *xprotect_meta.type* - Either plugin or extension

**type_name** - keyword, text.text

* *last.type_name* - Entry type name, according to ut_type types (utmp.h)
* *shared_resources.type_name* - Human readable value for the *type* column

**uid** - keyword

* *account_policy_data.uid* - User ID
* *asl.uid* - UID that sent the log message (set by the server).
* *authorized_keys.uid* - The local owner of authorized_keys file
* *bpf_process_events.uid* - User ID
* *bpf_socket_events.uid* - User ID
* *browser_plugins.uid* - The local user that owns the plugin
* *chrome_extension_content_scripts.uid* - The local user that owns the extension
* *chrome_extensions.uid* - The local user that owns the extension
* *crashes.uid* - User ID of the crashed process
* *device_file.uid* - Owning user ID
* *disk_encryption.uid* - Currently authenticated user if available
* *docker_container_processes.uid* - User ID
* *es_process_events.uid* - User ID of the process
* *file.uid* - Owning user ID
* *file_events.uid* - Owning user ID
* *firefox_addons.uid* - The local user that owns the addon
* *kernel_keys.uid* - The user ID of the key owner.
* *known_hosts.uid* - The local user that owns the known_hosts file
* *launchd_overrides.uid* - User ID applied to the override, 0 applies to all
* *package_bom.uid* - Expected user of file or directory
* *password_policy.uid* - User ID for the policy, -1 for policies that are global
* *process_events.uid* - User ID at process start
* *process_file_events.uid* - The uid of the process performing the action
* *processes.uid* - Unsigned user ID
* *safari_extensions.uid* - The local user that owns the extension
* *seccomp_events.uid* - User ID of the user who started the analyzed process
* *shell_history.uid* - Shell history owner
* *ssh_configs.uid* - The local owner of the ssh_config file
* *user_events.uid* - User ID
* *user_groups.uid* - User ID
* *user_ssh_keys.uid* - The local user that owns the key file
* *users.uid* - User ID
* *vscode_extensions.uid* - The local user that owns the plugin

**uid_signed** - keyword, number.long

* *users.uid_signed* - User ID as int64 signed (Apple)

**umci_policy_status** - keyword, text.text

* *hvci_status.umci_policy_status* - The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.

**uncompressed** - keyword, number.long

* *virtual_memory_info.uncompressed* - Total number of uncompressed pages.

**uninstall_string** - keyword, text.text

* *programs.uninstall_string* - Path and filename of the uninstaller.

**unique_chip_id** - keyword, text.text

* *ibridge_info.unique_chip_id* - Unique id of the iBridge controller

**unit_file_state** - keyword, text.text

* *systemd_units.unit_file_state* - Whether the unit file is enabled, e.g. `enabled`, `masked`, `disabled`, etc

**unix_time** - keyword, number.long

* *time.unix_time* - Current UNIX time in UTC

**unmask** - keyword, number.long

* *portage_keywords.unmask* - If the package is unmasked

**unused_devices** - keyword, text.text

* *md_devices.unused_devices* - Unused devices

**update_id** - keyword, text.text

* *windows_update_history.update_id* - Revision-independent identifier of an update

**update_revision** - keyword, number.long

* *windows_update_history.update_revision* - Revision number of an update

**update_source_alias** - keyword, text.text

* *lxd_images.update_source_alias* - Alias of image at update source server

**update_source_certificate** - keyword, text.text

* *lxd_images.update_source_certificate* - Certificate for update source server

**update_source_protocol** - keyword, text.text

* *lxd_images.update_source_protocol* - Protocol used for image information update and image import from source server

**update_source_server** - keyword, text.text

* *lxd_images.update_source_server* - Server for image update

**update_url** - keyword, text.text

* *chrome_extensions.update_url* - Extension-supplied update URI
* *safari_extensions.update_url* - Extension-supplied update URI

**upid** - keyword, number.long

* *processes.upid* - A 64bit pid that is never reused. Returns -1 if we couldn’t gather them from the system.

**uploaded_at** - keyword, text.text

* *lxd_images.uploaded_at* - ISO time of image upload

**upn** - keyword, text.text

* *logon_sessions.upn* - The user principal name (UPN) for the owner of the logon session.

**uppid** - keyword, number.long

* *processes.uppid* - The 64bit parent pid that is never reused. Returns -1 if we couldn’t gather them from the system.

**uptime** - keyword, number.long

* *apparmor_events.uptime* - Time of execution in system uptime
* *kernel_panics.uptime* - System uptime at kernel panic in nanoseconds
* *process_events.uptime* - Time of execution in system uptime
* *process_file_events.uptime* - Time of execution in system uptime
* *seccomp_events.uptime* - Time of execution in system uptime
* *selinux_events.uptime* - Time of execution in system uptime
* *socket_events.uptime* - Time of execution in system uptime
* *user_events.uptime* - Time of execution in system uptime

**url** - keyword, text.text

* *curl.url* - The url for the request
* *lxd_cluster_members.url* - URL of the node

**usage** - keyword, number.long

* *kernel_keys.usage* - the number of threads and open file references that refer to this key.

**usb_address** - keyword, number.long

* *usb_devices.usb_address* - USB Device used address

**usb_port** - keyword, number.long

* *usb_devices.usb_port* - USB Device used port

**use** - keyword, text.text

* *memory_arrays.use* - Function for which the array is used
* *portage_use.use* - USE flag which has been enabled for package

**used_by** - keyword, text.text

* *kernel_modules.used_by* - Module reverse dependencies
* *lxd_networks.used_by* - URLs for containers using this network

**user** - keyword

* *cpu_time.user* - Time spent in user mode
* *cups_jobs.user* - The user who printed the job
* *docker_container_processes.user* - User name
* *logged_in_users.user* - User login name
* *logon_sessions.user* - The account name of the security principal that owns the logon session.
* *sandboxes.user* - Sandbox owner
* *systemd_units.user* - The configured user, if any

**user_account** - keyword, text.text

* *services.user_account* - The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\UserName. If the account belongs to the built-in domain, the name can be of the form .\UserName.

**user_account_control** - keyword, text.text

* *windows_security_center.user_account_control* - The health of the User Account Control (UAC) capability in Windows

**user_action** - keyword, text.text

* *xprotect_reports.user_action* - Action taken by user after prompted

**user_agent** - keyword, text.text

* *curl.user_agent* - The user-agent string to use for the request

**user_namespace** - keyword, text.text

* *docker_containers.user_namespace* - User namespace
* *process_namespaces.user_namespace* - user namespace inode

**user_time** - keyword, number.long

* *osquery_schedule.user_time* - Total user time in milliseconds spent executing
* *processes.user_time* - CPU time in milliseconds spent in user space

**user_uuid** - keyword, text.text

* *disk_encryption.user_uuid* - UUID of authenticated user if available

**username** - keyword, text.text

* *certificates.username* - Username
* *es_process_events.username* - Username
* *last.username* - Entry username
* *launchd.username* - Run this daemon or agent as this username
* *managed_policies.username* - Policy applies only this user
* *preferences.username* - (optional) read preferences for a specific user
* *process_etw_events.username* - User rights - primary token username
* *rpm_package_files.username* - File default username from info DB
* *shadow.username* - Username
* *startup_items.username* - The user associated with the startup item
* *suid_bin.username* - Binary owner username
* *users.username* - Username
* *windows_crashes.username* - Username of the user who ran the crashed process

**uses_pattern** - keyword, number.long

* *xprotect_entries.uses_pattern* - Uses a match pattern instead of identity

**uts_namespace** - keyword, text.text

* *docker_containers.uts_namespace* - UTS namespace
* *process_namespaces.uts_namespace* - uts namespace inode

**uuid** - keyword, text.text

* *block_devices.uuid* - Block device Universally Unique Identifier
* *disk_encryption.uuid* - Disk Universally Unique Identifier
* *disk_events.uuid* - UUID of the volume inside DMG if available
* *managed_policies.uuid* - Optional UUID assigned to policy set
* *osquery_extensions.uuid* - The transient ID assigned for communication
* *osquery_info.uuid* - Unique ID provided by the system
* *system_info.uuid* - Unique ID provided by the system
* *users.uuid* - User’s UUID (Apple) or SID (Windows)
* *vscode_extensions.uuid* - Extension UUID

**valid_from** - keyword, text.text

* *curl_certificate.valid_from* - Period of validity start date

**valid_to** - keyword, text.text

* *curl_certificate.valid_to* - Period of validity end date

**value** - keyword, text.text

* *ad_config.value* - Variable typed option value
* *augeas.value* - The value of the configuration item
* *azure_instance_tags.value* - The tag value
* *cpuid.value* - Bit value or string
* *default_environment.value* - Value of the environment variable
* *docker_container_envs.value* - Environment variable value
* *docker_container_labels.value* - Optional label value
* *docker_image_labels.value* - Optional label value
* *docker_network_labels.value* - Optional label value
* *docker_volume_labels.value* - Optional label value
* *ec2_instance_tags.value* - Tag value
* *extended_attributes.value* - The parsed information from the attribute
* *launchd_overrides.value* - Overridden value
* *lxd_instance_config.value* - Configuration parameter value
* *lxd_instance_devices.value* - Device info param value
* *managed_policies.value* - Policy value
* *mdls.value* - Value stored in the metadata key
* *nvram.value* - Raw variable data
* *oem_strings.value* - The value of the OEM string
* *osquery_flags.value* - Flag value
* *plist.value* - String value of most CF types
* *power_sensors.value* - Power in Watts
* *preferences.value* - String value of most CF types
* *process_envs.value* - Environment variable value
* *selinux_settings.value* - Active value.
* *smc_keys.value* - A type-encoded representation of the key value
* *wmi_bios_info.value* - Value of the Bios setting

**valuetype** - keyword, text.text

* *mdls.valuetype* - CoreFoundation type of data stored in value

**variable** - keyword, text.text

* *default_environment.variable* - Name of the environment variable

**vbs_status** - keyword, text.text

* *hvci_status.vbs_status* - The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.

**vendor** - keyword, text.text

* *block_devices.vendor* - Block device vendor string
* *disk_events.vendor* - Disk event vendor string
* *hardware_events.vendor* - Hardware device vendor
* *pci_devices.vendor* - PCI Device vendor
* *platform_info.vendor* - Platform code vendor
* *rpm_packages.vendor* - Package vendor
* *usb_devices.vendor* - USB Device vendor string

**vendor_id** - keyword, text.text

* *connected_displays.vendor_id* - The vendor ID of the display.
* *hardware_events.vendor_id* - Hex encoded Hardware vendor identifier
* *pci_devices.vendor_id* - Hex encoded PCI Device vendor identifier
* *usb_devices.vendor_id* - Hex encoded USB Device vendor identifier

**vendor_syndrome** - keyword, text.text

* *memory_error_info.vendor_syndrome* - Vendor specific ECC syndrome or CRC data associated with the erroneous access

**version** - keyword, text.text

* *alf.version* - Application Layer Firewall version
* *apt_sources.version* - Repository source version
* *authorizations.version* - Label top-level key
* *azure_instance_metadata.version* - Version of the VM image
* *bitlocker_info.version* - The FVE metadata version of the drive.
* *browser_plugins.version* - Plugin short version
* *chocolatey_packages.version* - Package-supplied version
* *chrome_extension_content_scripts.version* - Extension-supplied version
* *chrome_extensions.version* - Extension-supplied version
* *crashes.version* - Version info of the crashed process
* *curl_certificate.version* - Version Number
* *deb_packages.version* - Package version
* *device_firmware.version* - Firmware version
* *docker_version.version* - Docker version
* *drivers.version* - Driver version
* *es_process_events.version* - Version of EndpointSecurity event
* *es_process_file_events.version* - Version of EndpointSecurity event
* *firefox_addons.version* - Addon-supplied version string
* *gatekeeper.version* - Version of Gatekeeper’s gke.bundle
* *homebrew_packages.version* - Current *linked* version
* *hvci_status.version* - The version number of the Device Guard build.
* *ie_extensions.version* - Version of the executable
* *intel_me_info.version* - Intel ME version
* *kernel_extensions.version* - Extension version
* *kernel_info.version* - Kernel version
* *npm_packages.version* - Package-supplied version
* *office_mru.version* - Office application version number
* *os_version.version* - Pretty, suitable for presentation, OS version
* *osquery_extensions.version* - Extension’s version
* *osquery_info.version* - osquery toolkit version
* *osquery_packs.version* - Minimum osquery version that this query will run on
* *package_install_history.version* - Package display version
* *package_receipts.version* - Installed package version
* *platform_info.version* - Platform code version
* *portage_keywords.version* - The version which are affected by the use flags, empty means all
* *portage_packages.version* - The version which are affected by the use flags, empty means all
* *portage_use.version* - The version of the installed package
* *programs.version* - Product version information.
* *python_packages.version* - Package-supplied version
* *rpm_packages.version* - Package version
* *safari_extensions.version* - Extension long version
* *system_extensions.version* - System extension version
* *usb_devices.version* - USB Device version number
* *vscode_extensions.version* - Extension version
* *windows_crashes.version* - File version info of the crashed process

**video_mode** - keyword, text.text

* *video_info.video_mode* - The current resolution of the display.

**virtual_process** - keyword, number.long

* *processes.virtual_process* - Process is virtual (e.g. System, Registry, vmmem) yes=1, no=0

**visible** - keyword, number.long

* *firefox_addons.visible* - 1 If the addon is shown in browser else 0

**visible_alarm** - keyword, text.text

* *chassis_info.visible_alarm* - If TRUE, the frame is equipped with a visual alarm.

**vm_id** - keyword, text.text

* *azure_instance_metadata.vm_id* - Unique identifier for the VM
* *azure_instance_tags.vm_id* - Unique identifier for the VM

**vm_scale_set_name** - keyword, text.text

* *azure_instance_metadata.vm_scale_set_name* - VM scale set name

**vm_size** - keyword, text.text

* *azure_instance_metadata.vm_size* - VM size

**voltage** - keyword, number.long

* *battery.voltage* - The battery’s current voltage in mV

**volume_creation** - keyword, text.text

* *prefetch.volume_creation* - Volume creation time.

**volume_id** - keyword, number.long

* *quicklook_cache.volume_id* - Parsed volume ID from fs_id

**volume_serial** - keyword, text.text

* *file.volume_serial* - Volume serial number
* *prefetch.volume_serial* - Volume serial number.

**volume_size** - keyword, number.long

* *platform_info.volume_size* - (Optional) size of firmware volume

**wall_time** - keyword, number.long

* *osquery_schedule.wall_time* - Total wall time in seconds spent executing (deprecated), hidden=True

**wall_time_ms** - keyword, number.long

* *osquery_schedule.wall_time_ms* - Total wall time in milliseconds spent executing

**warning** - keyword, number.long

* *shadow.warning* - Number of days before password expires to warn user about it

**was_captive_network** - keyword, number.long

* *wifi_networks.was_captive_network* - 1 if this network was previously a captive network, 0 otherwise

**watch_paths** - keyword, text.text

* *launchd.watch_paths* - Key that launches daemon or agent if path is modified

**watcher** - keyword, number.long

* *osquery_info.watcher* - Process (or thread/handle) ID of optional watcher process

**weekday** - keyword, text.text

* *time.weekday* - Current weekday in UTC

**win32_exit_code** - keyword, number.long

* *services.win32_exit_code* - The error code that the service uses to report an error that occurs when it is starting or stopping

**win_timestamp** - keyword, number.long

* *time.win_timestamp* - Timestamp value in 100 nanosecond units

**windows_security_center_service** - keyword, text.text

* *windows_security_center.windows_security_center_service* - The health of the Windows Security Center Service

**wired** - keyword, number.long

* *virtual_memory_info.wired* - Total number of wired down pages.

**wired_size** - keyword, number.long

* *docker_container_processes.wired_size* - Bytes of unpageable memory used by process
* *processes.wired_size* - Bytes of unpageable memory used by process

**working_directory** - keyword, text.text

* *launchd.working_directory* - Key used to specify a directory to chdir to before launch

**working_disks** - keyword, number.long

* *md_devices.working_disks* - Number of working disks in array

**world** - keyword, number.long

* *portage_packages.world* - If package is in the world file

**writable** - keyword, number.long

* *disk_events.writable* - 1 if writable, 0 if not

**xpath** - keyword, text.text

* *windows_eventlog.xpath* - The custom query to filter events

**year** - keyword, number.long

* *time.year* - Current year in UTC

**zero_fill** - keyword, number.long

* *virtual_memory_info.zero_fill* - Total number of zero filled pages.

**zone** - keyword, text.text

* *azure_instance_metadata.zone* - Availability zone of the VM
* *ycloud_instance_metadata.zone* - Availability zone of the VM