mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 00:18:27 +00:00
25 lines
No EOL
934 B
YAML
25 lines
No EOL
934 B
YAML
name: filevault_users
|
|
notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).
|
|
description: Information on the users able to unlock the current boot volume if protected with FileVault.
|
|
platforms:
|
|
- darwin
|
|
evented: false
|
|
examples: >-
|
|
List the usernames able to unlock and boot a computer protected by FileVault, joined to
|
|
[users.username](http://fleetdm.com/tables/users) to obtain the description of the operating
|
|
system account that owns it.
|
|
|
|
```
|
|
|
|
SELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;
|
|
|
|
```
|
|
columns:
|
|
- name: username
|
|
description: Username of the FileVault user.
|
|
required: false
|
|
type: text
|
|
- name: uuid
|
|
description: UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).
|
|
required: false
|
|
type: text |