b89cc578ca
**Related issue:** Resolves #36799, Sub-task: #41556 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <img width="924" height="278" alt="Screenshot 2026-03-16 at 10 46 38 AM" src="https://github.com/user-attachments/assets/313b6650-a849-4bc2-ba14-a62d3d13b60c" /> <img width="1441" height="300" alt="Screenshot 2026-03-16 at 10 46 44 AM" src="https://github.com/user-attachments/assets/915cfd26-168f-4621-bcf5-6c26c40e5faf" /> <img width="1923" height="788" alt="Screenshot 2026-03-16 at 10 54 04 AM" src="https://github.com/user-attachments/assets/62356a3e-84fe-4561-b7ad-0a35c9db3b2a" /> <img width="2529" height="483" alt="Screenshot 2026-03-16 at 10 47 02 AM" src="https://github.com/user-attachments/assets/4dc51073-2c24-4934-bd9d-c5ee648d5ae1" /> Tested that with latest released fleetd (1.53.0), we still ingest the available disk space. There's about 5% difference in the UI vs in the macOS "Get Info" dialog (expected, since we use the old query, now called `disk_space_darwin_legacy`): <img width="267" height="306" alt="Screenshot 2026-03-17 at 8 47 22 AM" src="https://github.com/user-attachments/assets/73fc1eef-a32c-4d8d-a9ca-13980885f8fe" /> <img width="883" height="407" alt="Screenshot 2026-03-17 at 8 47 33 AM" src="https://github.com/user-attachments/assets/98851b9b-82a8-4ac8-af5c-dbb878f85fad" /> <img width="159" height="127" alt="Screenshot 2026-03-17 at 8 47 40 AM" src="https://github.com/user-attachments/assets/209f784a-29a8-4af5-b95d-0f9bd59917c9" /> Also tested running with vanilla osquery by stopping fleetd and then running osquery manually (adding the `--allow_unsafe` flag). Result is same as above, `disk_space_darwin_legacy` is used: <img width="1152" height="418" alt="Screenshot 2026-03-17 at 8 59 23 AM" src="https://github.com/user-attachments/assets/2b34d23d-61de-4ec1-8d1c-2d3ddb682d11" /> <img width="893" height="414" alt="Screenshot 2026-03-17 at 8 59 28 AM" src="https://github.com/user-attachments/assets/d28ee8fb-08c5-434f-abfa-3825b27ac73b" /> ## Summary - Adds a new macOS-only fleetd table `disk_space` that uses `NSURLVolumeAvailableCapacityForImportantUsageKey` to report available disk capacity including purgeable storage — matching what macOS shows in Finder's "Get Info" dialog. - Adds a new `disk_space_darwin` detail query that uses the new table (with Discovery, so it only runs on hosts with fleetd ≥ 1.54.0). - Restricts the existing `disk_space_unix` query to Linux only (darwin was removed since the new query handles it). - Adds schema documentation for the new table. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| tables | ||
| osquery_fleet_schema.json | ||
| README.md | ||
Hello! Welcome to Fleet's osquery tables documentation.
This folder contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users.
Fleet's schema tables live in the tables/ folder. Each osquery table with Fleet overrides has a corresponding YAML file that will override information in the osquery schema documentation.
The existing documentation data lives in the osquery repo at: https://github.com/osquery/osquery-site/tree/source/src/data/osquery_schema_versions.
You can open PRs against a table's YAML file in the tables/ folder or the osquery schema file. Just note that the data in a table's YAML file overwrites the osquery data whenever there is a conflict:
-
Clone the fleetdm/fleet repository.
-
Add or modify the table's YAML file, move to the
websitedirectory in the project root and runnode ./node_modules/sails/bin/sails run generate-merged-schemato generate the merged JSON schema.
Alternatively, you can find the table's page on the Fleet website and click the "edit page" button.
When adding a new table or overriding an existing table use this template:
name: # (required) string - The name of the table.
evented: # boolean - whether or not this table is evented. This value may be required depending on the table's source.
description: |- # (required) string - The description for this table. Note: this field supports markdown
# Add description here
examples: |- # (optional) string - An example query for this table. Note: This field supports markdown
# Add examples here
notes: |- # (optional) string - Notes about this table. Note: This field supports markdown.
# Add notes here
platforms: |- # (optional) array - A list of supported platforms for this table (any of: `darwin`, `windows`, `linux`, `chrome`)
# Add platforms here
columns: # (required) array - An array of columns in this table
- name: # (required) string - The name of the column
description: # (required) string - The column's description
type: # (required) string - the column's data type
required: # (required) boolean - whether or not this column is required to query this table.
platforms: # (optional) array - List of supported platforms, used to clarify when a column isn't available on every platform its table supports (any of: `darwin`, `windows`, `linux`, `chrome`)