@wkleinhenz if you are using Kolide's SaaS product and/or launcher you can get USB information using the

kolide_wmi

table, if you have only vanilla osquery you can get a little more brittle and cobble something together using the

registry

table like so:

yeah im using fleetdm with launcher, the table doesnt seem to be in the built in table help but i can give both a shot thanks

IIRC fleetdm is now using their own extension (orbit?) instead of launcher

yeah right now were still using launcher with fleetdm, i had some issues moving to orbit but its on my radar

👍