https://github.com/osquery/osquery logo
#macos
Title
# macos
t

Terje Kvernes

11/14/2022, 3:06 PM
Hm, in the fleetdm UI there is a field for macs, “Used by”, which shows an email address that is probably used for iCloud at some point for the host. Does anyone where this data is gathered from?
s

sharvil

11/14/2022, 3:10 PM
This data is gathered from Google Chrome profiles
t

Terje Kvernes

11/14/2022, 3:15 PM
Ah, wow. That’s interesting. Is there an accompanying search that would achieve the same?
Thanks by the way, I found the source of the confusion. 🙂
s

sharvil

11/14/2022, 3:17 PM
Yep, that’s from
google_chrome_profiles
table (docs: https://fleetdm.com/tables/google_chrome_profiles), note that this requires the macadmins osquery extension
t

Terje Kvernes

11/14/2022, 3:20 PM
I can’t see the table in the fleetdm UI, but the field was filled out. That’s a bit confusing.
s

sharvil

11/14/2022, 3:22 PM
that is indeed confusing, does a
select * from google_chrome_profiles;
return any data..
and I will try to get this surfaced to the relevant team
t

Terje Kvernes

11/14/2022, 3:22 PM
Yup
It works when I manually use the table, it’s just not there in the sidebar.
s

sharvil

11/14/2022, 3:24 PM
ah..gotcha, I think that's because
google_chrome_profiles
is an extension table, and not all hosts might have it by default
but I agree, this can be confusing
t

Terje Kvernes

11/14/2022, 3:25 PM
That makes sort of sense, but we have windows-only tables in the sidebar even though the site I have has zero windows machines. 🙂
s

sharvil

11/14/2022, 3:26 PM
right, those are default osquery core tables
let me surface this internally, and see if it's on the roadmap to expose this in UI as well
t

Terje Kvernes

11/14/2022, 3:27 PM
Thanks! Is there a way for me to see what tables I actually have? I mean, outside of
show tables
in the database? 🙂
(that works too though, so no real worries)
s

sharvil

11/14/2022, 3:29 PM
good question, I am not aware of any other than seeing the db, let me try and dig in if there is one
t

Terje Kvernes

11/14/2022, 3:30 PM
Thanks! I’m setting up this test site to document Fleet and OSquery for others, so most of the users likely won’t have direct DB access. 🙂
s

sharvil

11/14/2022, 3:31 PM
this might be a start (https://fleetdm.com/tables) (you can filter by platform up top on that page) -- this shows both the osquery core tables as well as the ones included by fleet
t

Terje Kvernes

11/14/2022, 3:32 PM
Oh, it shows up there! Of course! It didn’t even occur to me that this would be different from the sidebar. Even if I think we should see them in the sidebar, that’s brilliant, thanks!