diff --git a/changes/use-custom-table-for-macos-cis-5.1.6-and-5.1.7 b/changes/use-custom-table-for-macos-cis-5.1.6-and-5.1.7
new file mode 100644
index 0000000000..8825608f96
--- /dev/null
+++ b/changes/use-custom-table-for-macos-cis-5.1.6-and-5.1.7
@@ -0,0 +1 @@
+* For performance reasons, update macOS CIS policies 5.1.6 and 5.1.7 to use a new fleetd table `find_cmd` instead of relying on the osquery `file` table.
diff --git a/ee/cis/macos-13/cis-policy-queries.yml b/ee/cis/macos-13/cis-policy-queries.yml
index 6c340a71c9..4beb26f2b7 100644
--- a/ee/cis/macos-13/cis-policy-queries.yml
+++ b/ee/cis/macos-13/cis-policy-queries.yml
@@ -2621,10 +2621,11 @@ spec:
     SELECT 1 WHERE NOT EXISTS (
       SELECT apps.path FROM apps
       LEFT JOIN file on file.path = apps.path
+      WHERE apps.path LIKE '/Applications/%' AND
       -- file.mode's last character are the permissions for 'other',
       -- bitwise && with '0x2' selects the write permission,
       -- which we do not want here.
-      WHERE CAST(SUBSTRING(file.mode, -1) AS INTEGER) & 0x2 != 0
+      CAST(SUBSTRING(file.mode, -1) AS INTEGER) & 0x2 != 0
     );
   purpose: Informational
   tags: compliance, CIS, CIS_Level1, CIS-macos-13-5.1.5
@@ -2650,11 +2651,11 @@ spec:
     done
   query: |
     SELECT 1 WHERE NOT EXISTS (
-    SELECT 1 FROM file WHERE 
-      path LIKE '/System/Volumes/Data/System/%%'  
-      AND type = 'directory' 
-      AND directory NOT LIKE '%Drop Box%' 
-      AND   CAST( SUBSTRING( mode ,-1) AS INTEGER) & 0x2 !=0 -- mode last char is others' permissions. bitwise with 0x2 means write permissions. (which we do not want here) 
+      SELECT 1 FROM find_cmd WHERE
+        directory = '/System/Volumes/Data/System'
+        AND type = 'd'
+        AND perm = '-2'
+        AND path NOT LIKE '%Drop Box%'
     );
   purpose: Informational
   tags: compliance, CIS, CIS_Level1, CIS-macos-13-5.1.6
@@ -2678,12 +2679,12 @@ spec:
     done
   query: |
     SELECT 1 WHERE NOT EXISTS (
-    SELECT 1 FROM file WHERE 
-      path LIKE '/System/Volumes/Data/Library/%%'
-      AND type = 'directory' 
-      AND directory NOT LIKE '%Caches%' 
-      AND directory NOT LIKE '%/Preferences/Audio/Data%' 
-      AND   CAST( SUBSTRING( mode ,-1) AS INTEGER) & 0x2 !=0 -- mode last char is others' permissions. bitwise with 0x2 means write permissions. (which we do not want here) 
+      SELECT 1 FROM find_cmd WHERE
+        directory = '/System/Volumes/Data/Library'
+        AND type = 'd'
+        AND perm = '-2'
+        AND path NOT LIKE '%Caches%'
+        AND path NOT LIKE '%/Preferences/Audio/Data%'
     );
   purpose: Informational
   tags: compliance, CIS, CIS_Level2, CIS-macos-13-5.1.7
diff --git a/orbit/pkg/table/extension_darwin.go b/orbit/pkg/table/extension_darwin.go
index 1849c850f3..c97ac7b67f 100644
--- a/orbit/pkg/table/extension_darwin.go
+++ b/orbit/pkg/table/extension_darwin.go
@@ -9,6 +9,7 @@ import (
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/diskutil/corestorage"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/dscl"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/filevault_prk"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/table/find_cmd"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/firmware_eficheck_integrity_check"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/nvram_info"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/table/pmset"
@@ -46,6 +47,7 @@ func PlatformTables() []osquery.OsqueryPlugin {
 		table.NewPlugin("corestorage_logical_volumes", corestorage.LogicalVolumesColumns(), corestorage.LogicalVolumesGenerate),
 		table.NewPlugin("corestorage_logical_volume_families", corestorage.LogicalVolumeFamiliesColumns(), corestorage.LogicalVolumeFamiliesGenerate),
 		table.NewPlugin("filevault_prk", filevault_prk.Columns(), filevault_prk.Generate),
+		table.NewPlugin("find_cmd", find_cmd.Columns(), find_cmd.Generate),
 
 		// Macadmins extension tables
 		table.NewPlugin("filevault_users", filevaultusers.FileVaultUsersColumns(), filevaultusers.FileVaultUsersGenerate),
diff --git a/orbit/pkg/table/find_cmd/find_cmd_darwin.go b/orbit/pkg/table/find_cmd/find_cmd_darwin.go
new file mode 100644
index 0000000000..36c0fea6a6
--- /dev/null
+++ b/orbit/pkg/table/find_cmd/find_cmd_darwin.go
@@ -0,0 +1,146 @@
+//go:build darwin
+// +build darwin
+
+// Package find_cmd implements a table that executes the /usr/bin/find command.
+// This table provides only a subset of the find functionality. Currently only
+// allows setting the -perm and -type arguments.
+//
+// NOTE(lucas): Why does this table exist?
+// Initially we implemented queries that used the osquery core `file` table,
+// but when processing a high number (10k+) of files it exceeded osquery
+// default CPU and memory limits.
+package find_cmd
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/osquery/osquery-go/plugin/table"
+	"github.com/rs/zerolog/log"
+)
+
+// Columns is the schema of the table.
+func Columns() []table.ColumnDefinition {
+	return []table.ColumnDefinition{
+		// directory is the first argument of the find command (basically
+		// where to search for files).
+		table.TextColumn("directory"),
+		// type allows setting find's '-type' argument.
+		table.TextColumn("type"),
+		// perm allows setting find's '-perm' argument.
+		table.TextColumn("perm"),
+		// path are the found directories.
+		table.TextColumn("path"),
+	}
+}
+
+var permRegexp = regexp.MustCompile("[-+]*\\d+")
+
+// Generate is called to return the results for the table at query time.
+//
+// Constraints for generating can be retrieved from the queryContext.
+func Generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
+	getArgumentOpEqual := func(argName string) string {
+		argValue := ""
+		if constraints, ok := queryContext.Constraints[argName]; ok {
+			for _, constraint := range constraints.Constraints {
+				if constraint.Operator == table.OperatorEquals {
+					argValue = constraint.Expression
+				}
+			}
+		}
+		return argValue
+	}
+
+	directory := getArgumentOpEqual("directory")
+	if directory == "" {
+		return nil, errors.New("missing directory argument")
+	}
+	if !filepath.IsAbs(directory) {
+		return nil, errors.New("directory must be an absolute path")
+	}
+
+	findType := getArgumentOpEqual("type")
+	if findType != "" {
+		switch findType {
+		case "b", "c", "d", "f", "l", "p", "s":
+			// OK
+		default:
+			return nil, errors.New("type must be one of: 'b', 'c', 'd', 'f', 'l', 'p' or 's'")
+		}
+	}
+
+	perm := getArgumentOpEqual("perm")
+	if perm != "" {
+		if !permRegexp.Match([]byte(perm)) {
+			return nil, fmt.Errorf("perm must be of the form: %s", permRegexp)
+		}
+	}
+
+	args := []string{directory}
+	if findType != "" {
+		args = append(args, "-type", findType)
+	}
+	if perm != "" {
+		args = append(args, "-perm", perm)
+	}
+
+	cmd := exec.Command("/usr/bin/find", args...)
+	stdoutPipe, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("create stdout pipe: %w", err)
+	}
+	stderrPipe, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, fmt.Errorf("create stderr pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("command start failed: %w", err)
+	}
+
+	var outDirs []string
+	reader := bufio.NewReader(stdoutPipe)
+	line, err := reader.ReadString('\n')
+	for err == nil {
+		line = strings.TrimSuffix(line, "\n")
+		if line == "" {
+			continue
+		}
+		outDirs = append(outDirs, line)
+		line, err = reader.ReadString('\n')
+	}
+	if err != io.EOF {
+		return nil, fmt.Errorf("unexpected error: %w", err)
+	}
+
+	stderr, err := io.ReadAll(stderrPipe)
+	if err != nil {
+		log.Debug().Err(err).Msg("failed to read find stderr")
+	}
+
+	if err := cmd.Wait(); err != nil {
+		// We ignore error as these could be of the form:
+		// 'find: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted'
+		// which are files unaccessible even for root.
+		log.Debug().Err(err).Bytes("stderr", stderr).Msg("find failed")
+	}
+
+	rows := make([]map[string]string, 0, len(outDirs))
+	for _, outDir := range outDirs {
+		rows = append(rows, map[string]string{
+			"directory": directory,
+			"perm":      perm,
+			"type":      findType,
+			"path":      outDir,
+		})
+	}
+	return rows, nil
+}
diff --git a/orbit/pkg/table/find_cmd/find_cmd_darwin_test.go b/orbit/pkg/table/find_cmd/find_cmd_darwin_test.go
new file mode 100644
index 0000000000..08c6438cf4
--- /dev/null
+++ b/orbit/pkg/table/find_cmd/find_cmd_darwin_test.go
@@ -0,0 +1,188 @@
+//go:build darwin
+// +build darwin
+
+package find_cmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/osquery/osquery-go/plugin/table"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/context"
+)
+
+// TestGenerate tests the find_cmd table generation.
+func TestGenerate(t *testing.T) {
+	// Test not setting required column directory.
+	_, err := Generate(context.Background(), table.QueryContext{})
+	require.Error(t, err)
+
+	testDir := t.TempDir()
+
+	// Test with an empty directory.
+	rows, err := Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	require.Equal(t, rows[0]["path"], testDir)
+
+	// Test with invalid type argument.
+	_, err = Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+			"type": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: "z",
+					},
+				},
+			},
+		},
+	})
+	require.Error(t, err)
+
+	// Test with invalid perm argument.
+	_, err = Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+			"perm": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: "foobar",
+					},
+				},
+			},
+		},
+	})
+	require.Error(t, err)
+
+	// Populate the directory.
+	f, err := os.Create(filepath.Join(testDir, "foo.txt"))
+	require.NoError(t, err)
+	err = f.Close()
+	require.NoError(t, err)
+	err = os.Chmod(filepath.Join(testDir, "foo.txt"), os.ModePerm)
+	require.NoError(t, err)
+	require.NoError(t, err)
+	err = os.Mkdir(filepath.Join(testDir, "zoo"), os.ModePerm)
+	require.NoError(t, err)
+	err = os.Chmod(filepath.Join(testDir, "zoo"), os.ModePerm)
+	require.NoError(t, err)
+
+	// Test directory with a few entries.
+	rows, err = Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, rows, 3)
+	require.Equal(t, rows[0]["path"], testDir)
+	require.Equal(t, rows[1]["path"], filepath.Join(testDir, "zoo"))
+	require.Equal(t, rows[2]["path"], filepath.Join(testDir, "foo.txt"))
+
+	// Test directory with a few entries and setting the perm column.
+	rows, err = Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+			"perm": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: "-2",
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	require.Equal(t, rows[0]["path"], filepath.Join(testDir, "zoo"))
+	require.Equal(t, rows[1]["path"], filepath.Join(testDir, "foo.txt"))
+
+	// Test directory with a few entries and setting the perm and type column.
+	rows, err = Generate(context.Background(), table.QueryContext{
+		Constraints: map[string]table.ConstraintList{
+			"directory": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: testDir,
+					},
+				},
+			},
+			"perm": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: "-2",
+					},
+				},
+			},
+			"type": {
+				Affinity: table.ColumnTypeText,
+				Constraints: []table.Constraint{
+					{
+						Operator:   table.OperatorEquals,
+						Expression: "d",
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	require.Equal(t, rows[0]["path"], filepath.Join(testDir, "zoo"))
+}
diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json
index b67bb72a84..de498d1c3b 100644
--- a/schema/osquery_fleet_schema.json
+++ b/schema/osquery_fleet_schema.json
@@ -3,7 +3,9 @@
     "name": "account_policy_data",
     "description": "Additional macOS user account data from the AccountPolicy section of OpenDirectory.",
     "url": "https://fleetdm.com/tables/account_policy_data",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -61,7 +63,10 @@
     "name": "acpi_tables",
     "description": "Firmware ACPI functional table common metadata and content.",
     "url": "https://fleetdm.com/tables/acpi_tables",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -102,7 +107,9 @@
     "name": "ad_config",
     "description": "macOS Active Directory configuration.",
     "url": "https://fleetdm.com/tables/ad_config",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "\n- Active Directory is a directory service used to manage users and computers. A domain is the high level grouping of these objects, which a workstation must join in order to provide the user with features such as Single Sign-On to internal applications using Kerberos. \n- If a host is not bound to an Active Directory domain, then the table returns no results.",
@@ -151,7 +158,9 @@
     "name": "alf",
     "description": "Details about the status of the built-in firewall protection on this Mac.",
     "url": "https://fleetdm.com/tables/alf",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "- This table provides information about the built-in firewall in macOS, also known as [Application Layer Firewall (ALF)](https://support.apple.com/guide/mac-help/block-connections-to-your-mac-with-a-firewall-mh34041/mac)",
@@ -227,7 +236,9 @@
     "name": "alf_exceptions",
     "description": "The exceptions configured for the [built-in firewall protection](https://fleetdm.com/tables/alf) on this Mac.",
     "url": "https://fleetdm.com/tables/alf_exceptions",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -258,7 +269,9 @@
     "name": "alf_explicit_auths",
     "description": "ALF services explicitly allowed to perform networking.",
     "url": "https://fleetdm.com/tables/alf_explicit_auths",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "This table is currently affected by a [bug](https://github.com/osquery/osquery/issues/2322) and not returning applications visible in the preferences interface.",
@@ -280,7 +293,9 @@
     "name": "app_schemes",
     "description": "macOS application schemes and handlers (e.g., http, file, mailto).",
     "url": "https://fleetdm.com/tables/app_schemes",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -338,7 +353,9 @@
     "name": "apparmor_events",
     "description": "Track AppArmor events.",
     "url": "https://fleetdm.com/tables/apparmor_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -550,7 +567,9 @@
     "name": "apparmor_profiles",
     "description": "Track active AppArmor profiles.",
     "url": "https://fleetdm.com/tables/apparmor_profiles",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -609,7 +628,9 @@
     "name": "appcompat_shims",
     "description": "Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.",
     "url": "https://fleetdm.com/tables/appcompat_shims",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -677,7 +698,9 @@
     "name": "apps",
     "description": "macOS applications installed in known search paths (e.g., /Applications).",
     "url": "https://fleetdm.com/tables/apps",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -861,7 +884,9 @@
     "name": "apt_sources",
     "description": "Current list of APT repositories or software channels.",
     "url": "https://fleetdm.com/tables/apt_sources",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -947,7 +972,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apt_sources.yml"
@@ -956,7 +983,11 @@
     "name": "arp_cache",
     "description": "Address resolution cache, both static and dynamic (from ARP, NDP).",
     "url": "https://fleetdm.com/tables/arp_cache",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* The first six digits of a MAC address is the [Organizationally Unique Identifier (OUI)](https://en.wikipedia.org/wiki/Organizationally_unique_identifier).\n* You can lookup the manufacturer and model via the MAC address using a tool like [wireshark OUI lookup](https://www.wireshark.org/tools/oui-lookup.html).",
@@ -1005,7 +1036,9 @@
     "name": "asl",
     "description": "Queries the Apple System Log data structure for system events.",
     "url": "https://fleetdm.com/tables/asl",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1135,7 +1168,11 @@
     "name": "atom_packages",
     "description": "Lists all atom packages in a directory or globally installed in a system.",
     "url": "https://fleetdm.com/tables/atom_packages",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1212,7 +1249,10 @@
     "name": "augeas",
     "description": "Configuration files parsed by [augeas](https://augeas.net/).",
     "url": "https://fleetdm.com/tables/augeas",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1261,7 +1301,9 @@
     "name": "authenticode",
     "description": "File (executable, bundle, installer, disk) code signing status.",
     "url": "https://fleetdm.com/tables/authenticode",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1329,7 +1371,9 @@
     "name": "authorization_mechanisms",
     "description": "macOS Authorization mechanisms database.",
     "url": "https://fleetdm.com/tables/authorization_mechanisms",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1387,7 +1431,9 @@
     "name": "authorizations",
     "description": "macOS Authorization rights database.",
     "url": "https://fleetdm.com/tables/authorizations",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1508,7 +1554,10 @@
     "name": "authorized_keys",
     "description": "A line-delimited authorized_keys table.",
     "url": "https://fleetdm.com/tables/authorized_keys",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1577,7 +1626,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorized_keys.yml"
@@ -1586,7 +1637,9 @@
     "name": "autoexec",
     "description": "Aggregate of executables that will automatically execute on the target machine. This is an amalgamation of other tables like services, scheduled_tasks, startup_items and more.",
     "url": "https://fleetdm.com/tables/autoexec",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1627,7 +1680,11 @@
     "name": "azure_instance_metadata",
     "description": "Azure instance metadata.",
     "url": "https://fleetdm.com/tables/azure_instance_metadata",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -1784,7 +1841,11 @@
     "name": "azure_instance_tags",
     "description": "Azure instance tags.",
     "url": "https://fleetdm.com/tables/azure_instance_tags",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -1824,7 +1885,9 @@
     "name": "background_activities_moderator",
     "description": "Background Activities Moderator (BAM) tracks application execution.",
     "url": "https://fleetdm.com/tables/background_activities_moderator",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -1865,7 +1928,9 @@
     "name": "battery",
     "description": "Provides information about the internal battery of a Macbook.",
     "url": "https://fleetdm.com/tables/battery",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -2040,7 +2105,9 @@
     "name": "bitlocker_info",
     "description": "Retrieve bitlocker status of the machine.",
     "url": "https://fleetdm.com/tables/bitlocker_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* `protection_status` is quite nuanced - from the [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/secprov/getprotectionstatus-win32-encryptablevolume#parameters):\n\n `protection_status = 0`\n\n  For an Internal HD:\n  The volume is unencrypted, partially encrypted, or the volume's encryption key is available in the clear on the hard disk.\n\n  For an External HD:\n  The band for the volume is perpetually unlocked, has no key manager, or is managed by a third party key manager.\n  This can also mean that the band is managed by BitLocker but the DisableKeyProtectors method has been called and the drive is suspended.\n\n `protection_status = 1`\n\n  For an Internal HD:\n  The volume is fully encrypted and the encryption key for the volume is not available in the clear on the hard disk.\n\n  For an External HD:\n  BitLocker is the key manager for the band. The drive can be locked or unlocked but cannot be perpetually unlocked.\n\n `protection_status = 2`\n\n  The volume protection status cannot be determined. This can be caused by the volume being in a locked state.",
@@ -2134,7 +2201,10 @@
     "name": "block_devices",
     "description": "Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.",
     "url": "https://fleetdm.com/tables/block_devices",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -2228,7 +2298,9 @@
     "name": "bpf_process_events",
     "description": "Track time/action process executions.",
     "url": "https://fleetdm.com/tables/bpf_process_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -2395,7 +2467,9 @@
     "name": "bpf_socket_events",
     "description": "Track network socket opens and closes.",
     "url": "https://fleetdm.com/tables/bpf_socket_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -2607,7 +2681,9 @@
     "name": "browser_plugins",
     "description": "All C/NPAPI browser plugin details for all users. C/NPAPI has been deprecated on all major browsers. To query for plugins on modern browsers, try: `chrome_extensions` `firefox_addons` `safari_extensions`.",
     "url": "https://fleetdm.com/tables/browser_plugins",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -2711,7 +2787,11 @@
     "name": "carbon_black_info",
     "description": "Returns info about a Carbon Black sensor install.",
     "url": "https://fleetdm.com/tables/carbon_black_info",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -2913,7 +2993,11 @@
     "name": "carves",
     "description": "List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.",
     "url": "https://fleetdm.com/tables/carves",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -2999,7 +3083,11 @@
     "name": "certificates",
     "description": "[Certificate authorities](https://en.wikipedia.org/wiki/Certificate_authority) installed in Keychains/ca-bundles.",
     "url": "https://fleetdm.com/tables/certificates",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -3157,7 +3245,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "store_location",
@@ -3167,7 +3257,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "store",
@@ -3177,7 +3269,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "username",
@@ -3187,7 +3281,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "store_id",
@@ -3197,7 +3293,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "issuer2",
@@ -3207,7 +3305,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux", "macOS"]
+        "platforms": [
+          "Linux",
+          "macOS"
+        ]
       },
       {
         "name": "subject2",
@@ -3217,7 +3318,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux", "macOS"]
+        "platforms": [
+          "Linux",
+          "macOS"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/certificates.yml"
@@ -3226,7 +3330,9 @@
     "name": "chassis_info",
     "description": "Display information pertaining to the chassis and its security status.",
     "url": "https://fleetdm.com/tables/chassis_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -3357,7 +3463,9 @@
     "name": "chocolatey_packages",
     "description": "Chocolatey packages installed in a system.",
     "url": "https://fleetdm.com/tables/chocolatey_packages",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -3425,7 +3533,11 @@
     "name": "chrome_extension_content_scripts",
     "description": "Chrome browser extension content scripts.",
     "url": "https://fleetdm.com/tables/chrome_extension_content_scripts",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -3522,7 +3634,12 @@
     "name": "chrome_extensions",
     "description": "Installed extensions (plugins) for [Chromium-based](https://en.wikipedia.org/wiki/Chromium_(web_browser)) browsers, including [Google Chrome](https://en.wikipedia.org/wiki/Google_Chrome), [Edge](https://en.wikipedia.org/wiki/Microsoft_Edge), [Brave](https://en.wikipedia.org/wiki/Brave_(web_browser)), [Opera](https://en.wikipedia.org/wiki/Opera_(web_browser)), and [Yandex](https://en.wikipedia.org/wiki/Yandex_Browser).",
     "url": "https://fleetdm.com/tables/chrome_extensions",
-    "platforms": ["darwin", "windows", "linux", "chrome"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -3545,7 +3662,11 @@
         "hidden": false,
         "required": false,
         "index": true,
-        "platforms": ["macOS", "Windows", "Linux"],
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ],
         "requires_user_context": true
       },
       {
@@ -3565,7 +3686,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "profile_path",
@@ -3575,7 +3700,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "referenced_identifier",
@@ -3585,7 +3714,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "identifier",
@@ -3622,7 +3755,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "current_locale",
@@ -3632,7 +3769,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "update_url",
@@ -3651,7 +3792,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "persistent",
@@ -3661,7 +3806,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "path",
@@ -3698,7 +3847,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "optional_permissions_json",
@@ -3708,7 +3861,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "manifest_hash",
@@ -3718,7 +3875,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "referenced",
@@ -3728,7 +3889,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "from_webstore",
@@ -3738,7 +3903,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "state",
@@ -3757,7 +3926,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "install_timestamp",
@@ -3767,7 +3940,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "manifest_json",
@@ -3777,7 +3954,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "key",
@@ -3787,7 +3968,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extensions.yml"
@@ -3796,7 +3981,9 @@
     "name": "connectivity",
     "description": "Provides the overall system's network state.",
     "url": "https://fleetdm.com/tables/connectivity",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -3891,7 +4078,11 @@
     "name": "cpu_info",
     "description": "Retrieve cpu hardware info of the machine.",
     "url": "https://fleetdm.com/tables/cpu_info",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4004,7 +4195,11 @@
         "hidden": true,
         "required": false,
         "index": false,
-        "platforms": ["windows", "win32", "cygwin"]
+        "platforms": [
+          "windows",
+          "win32",
+          "cygwin"
+        ]
       },
       {
         "name": "number_of_efficiency_cores",
@@ -4014,7 +4209,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["darwin"]
+        "platforms": [
+          "darwin"
+        ]
       },
       {
         "name": "number_of_performance_cores",
@@ -4024,7 +4221,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["darwin"]
+        "platforms": [
+          "darwin"
+        ]
       }
     ],
     "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/cpu_info.table",
@@ -4034,7 +4233,10 @@
     "name": "cpu_time",
     "description": "Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.",
     "url": "https://fleetdm.com/tables/cpu_time",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4146,7 +4348,11 @@
     "name": "cpuid",
     "description": "Useful CPU features from the cpuid ASM call.",
     "url": "https://fleetdm.com/tables/cpuid",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4204,7 +4410,9 @@
     "name": "crashes",
     "description": "Application, System, and Mobile App crash logs.",
     "url": "https://fleetdm.com/tables/crashes",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4362,7 +4570,10 @@
     "name": "crontab",
     "description": "Line parsed values from system and user cron/tab.",
     "url": "https://fleetdm.com/tables/crontab",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -4448,7 +4659,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crontab.yml"
@@ -4457,7 +4670,9 @@
     "name": "cups_destinations",
     "description": "Returns all configured printers.",
     "url": "https://fleetdm.com/tables/cups_destinations",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4497,7 +4712,9 @@
     "name": "cups_jobs",
     "description": "Returns all completed print jobs from cups.",
     "url": "https://fleetdm.com/tables/cups_jobs",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4582,7 +4799,11 @@
     "name": "curl",
     "description": "Perform an http request and return stats about it.",
     "url": "https://fleetdm.com/tables/curl",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4658,7 +4879,11 @@
     "name": "curl_certificate",
     "description": "Inspect TLS certificates by connecting to input hostnames.",
     "url": "https://fleetdm.com/tables/curl_certificate",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -4959,7 +5184,9 @@
     "name": "deb_packages",
     "description": "The installed DEB package database.",
     "url": "https://fleetdm.com/tables/deb_packages",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -5072,7 +5299,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -5082,7 +5311,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/deb_packages.yml"
@@ -5091,7 +5322,9 @@
     "name": "default_environment",
     "description": "Default environment variables and values.",
     "url": "https://fleetdm.com/tables/default_environment",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5132,7 +5365,10 @@
     "name": "device_file",
     "description": "Similar to the file table, but use TSK and allow block address access.",
     "url": "https://fleetdm.com/tables/device_file",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5281,7 +5517,9 @@
     "name": "device_firmware",
     "description": "A best-effort list of discovered firmware versions.",
     "url": "https://fleetdm.com/tables/device_firmware",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5321,7 +5559,10 @@
     "name": "device_hash",
     "description": "Similar to the hash table, but use TSK and allow block address access.",
     "url": "https://fleetdm.com/tables/device_hash",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5389,7 +5630,10 @@
     "name": "device_partitions",
     "description": "Use TSK to enumerate details about partitions on a disk device.",
     "url": "https://fleetdm.com/tables/device_partitions",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5484,7 +5728,10 @@
     "name": "disk_encryption",
     "description": "Disk encryption status and information.",
     "url": "https://fleetdm.com/tables/disk_encryption",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5543,7 +5790,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "user_uuid",
@@ -5553,7 +5802,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "filevault_status",
@@ -5563,7 +5814,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_encryption.yml"
@@ -5572,7 +5825,9 @@
     "name": "disk_events",
     "description": "Track DMG disk image events (appearance/disappearance) when opened.",
     "url": "https://fleetdm.com/tables/disk_events",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -5729,7 +5984,10 @@
     "name": "disk_info",
     "description": "Retrieve basic information about the physical disks of a system.",
     "url": "https://fleetdm.com/tables/disk_info",
-    "platforms": ["windows", "chrome"],
+    "platforms": [
+      "windows",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "- For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 91+.",
@@ -5743,7 +6001,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "disk_index",
@@ -5753,7 +6013,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "type",
@@ -5781,7 +6043,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "disk_size",
@@ -5800,7 +6064,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "hardware_model",
@@ -5810,7 +6076,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "name",
@@ -5829,7 +6097,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "description",
@@ -5839,7 +6109,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_info.yml"
@@ -5848,7 +6120,9 @@
     "name": "dns_cache",
     "description": "Enumerate the DNS cache using the undocumented DnsGetCacheDataTable function in dnsapi.dll.",
     "url": "https://fleetdm.com/tables/dns_cache",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "\nThis table pulls from the local system's DNS cache. By default, the local DNS cache entry for a domain will be removed once the TTL for the domain has expired. For instance, osquery.io has a TTL of 60 seconds. When this domain has been resolved on a local Windows system, the DNS mapping will expire in 60 seconds from the resolution time - so `SELECT * FROM dns_cache WHERE name = 'osquery.io'` will only return results during that 60 second window.\nWindows has a maximum time that it allows a cache entry to exist- by default, it is 1 day. If the domain has a TTL of greater than 1 day, Windows will still remove the DNS entry from its cache after 1 day.",
@@ -5888,7 +6162,10 @@
     "name": "dns_resolvers",
     "description": "Resolvers used by this host.",
     "url": "https://fleetdm.com/tables/dns_resolvers",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5947,7 +6224,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_resolvers.yml"
@@ -5956,7 +6235,10 @@
     "name": "docker_container_envs",
     "description": "Docker container environment variables.",
     "url": "https://fleetdm.com/tables/docker_container_envs",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -5996,7 +6278,10 @@
     "name": "docker_container_fs_changes",
     "description": "Changes to files or directories on container's filesystem.",
     "url": "https://fleetdm.com/tables/docker_container_fs_changes",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6037,7 +6322,10 @@
     "name": "docker_container_labels",
     "description": "Docker container labels.",
     "url": "https://fleetdm.com/tables/docker_container_labels",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6077,7 +6365,10 @@
     "name": "docker_container_mounts",
     "description": "Docker container mounts.",
     "url": "https://fleetdm.com/tables/docker_container_mounts",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6171,7 +6462,10 @@
     "name": "docker_container_networks",
     "description": "Docker container networks.",
     "url": "https://fleetdm.com/tables/docker_container_networks",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6283,7 +6577,10 @@
     "name": "docker_container_ports",
     "description": "Docker container ports.",
     "url": "https://fleetdm.com/tables/docker_container_ports",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6341,7 +6638,10 @@
     "name": "docker_container_processes",
     "description": "Docker container processes.",
     "url": "https://fleetdm.com/tables/docker_container_processes",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6562,7 +6862,10 @@
     "name": "docker_container_stats",
     "description": "Docker container statistics. Queries on this table take at least one second.",
     "url": "https://fleetdm.com/tables/docker_container_stats",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6801,7 +7104,10 @@
     "name": "docker_containers",
     "description": "Docker containers information.",
     "url": "https://fleetdm.com/tables/docker_containers",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -6968,7 +7274,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "ipc_namespace",
@@ -6978,7 +7286,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mnt_namespace",
@@ -6988,7 +7298,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "net_namespace",
@@ -6998,7 +7310,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "pid_namespace",
@@ -7008,7 +7322,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "user_namespace",
@@ -7018,7 +7334,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "uts_namespace",
@@ -7028,7 +7346,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_containers.yml"
@@ -7037,7 +7357,10 @@
     "name": "docker_image_history",
     "description": "Docker image history information.",
     "url": "https://fleetdm.com/tables/docker_image_history",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7105,7 +7428,10 @@
     "name": "docker_image_labels",
     "description": "Docker image labels.",
     "url": "https://fleetdm.com/tables/docker_image_labels",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7146,7 +7472,10 @@
     "name": "docker_image_layers",
     "description": "Docker image layers information.",
     "url": "https://fleetdm.com/tables/docker_image_layers",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7187,7 +7516,10 @@
     "name": "docker_images",
     "description": "Docker images information.",
     "url": "https://fleetdm.com/tables/docker_images",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7236,7 +7568,10 @@
     "name": "docker_info",
     "description": "Docker system information.",
     "url": "https://fleetdm.com/tables/docker_info",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -7538,7 +7873,10 @@
     "name": "docker_network_labels",
     "description": "Docker network labels.",
     "url": "https://fleetdm.com/tables/docker_network_labels",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7579,7 +7917,10 @@
     "name": "docker_networks",
     "description": "Docker networks information.",
     "url": "https://fleetdm.com/tables/docker_networks",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7656,7 +7997,10 @@
     "name": "docker_version",
     "description": "Docker version information.",
     "url": "https://fleetdm.com/tables/docker_version",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -7751,7 +8095,10 @@
     "name": "docker_volume_labels",
     "description": "Docker volume labels.",
     "url": "https://fleetdm.com/tables/docker_volume_labels",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7792,7 +8139,10 @@
     "name": "docker_volumes",
     "description": "Docker volumes information.",
     "url": "https://fleetdm.com/tables/docker_volumes",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7844,7 +8194,9 @@
     "name": "drivers",
     "description": "Details for in-use Windows device drivers. This does not display installed but unused drivers.",
     "url": "https://fleetdm.com/tables/drivers",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -7984,7 +8336,11 @@
     "name": "ec2_instance_metadata",
     "description": "EC2 instance metadata.",
     "url": "https://fleetdm.com/tables/ec2_instance_metadata",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -8124,7 +8480,11 @@
     "name": "ec2_instance_tags",
     "description": "EC2 instance tag key value pairs.",
     "url": "https://fleetdm.com/tables/ec2_instance_tags",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -8165,7 +8525,9 @@
     "name": "es_process_events",
     "description": "Process execution events from EndpointSecurity.",
     "url": "https://fleetdm.com/tables/es_process_events",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -8422,7 +8784,9 @@
     "name": "es_process_file_events",
     "description": "Process execution events from EndpointSecurity.",
     "url": "https://fleetdm.com/tables/es_process_file_events",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -8535,7 +8899,11 @@
     "name": "etc_hosts",
     "description": "Line-parsed /etc/hosts.",
     "url": "https://fleetdm.com/tables/etc_hosts",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -8567,7 +8935,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_hosts.yml"
@@ -8576,7 +8946,11 @@
     "name": "etc_protocols",
     "description": "Line-parsed /etc/protocols.",
     "url": "https://fleetdm.com/tables/etc_protocols",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -8626,7 +9000,11 @@
     "name": "etc_services",
     "description": "Line-parsed /etc/services.",
     "url": "https://fleetdm.com/tables/etc_services",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -8684,7 +9062,9 @@
     "name": "event_taps",
     "description": "Returns information about installed event taps.",
     "url": "https://fleetdm.com/tables/event_taps",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -8742,7 +9122,10 @@
     "name": "extended_attributes",
     "description": "Returns the extended attributes for files (similar to Windows ADS).",
     "url": "https://fleetdm.com/tables/extended_attributes",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -8801,7 +9184,9 @@
     "name": "fan_speed_sensors",
     "description": "Fan speeds.",
     "url": "https://fleetdm.com/tables/fan_speed_sensors",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -8869,7 +9254,11 @@
     "name": "file",
     "description": "Interactive filesystem attributes and metadata.",
     "url": "https://fleetdm.com/tables/file",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9036,7 +9425,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "volume_serial",
@@ -9046,7 +9437,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "file_id",
@@ -9056,7 +9449,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "file_version",
@@ -9066,7 +9461,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "product_version",
@@ -9076,7 +9473,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "original_filename",
@@ -9086,7 +9485,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "bsd_flags",
@@ -9096,7 +9497,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "pid_with_namespace",
@@ -9106,7 +9509,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -9116,7 +9521,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file.yml"
@@ -9125,7 +9532,10 @@
     "name": "file_events",
     "description": "Track time/action changes to files specified in configuration data.",
     "url": "https://fleetdm.com/tables/file_events",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -9301,7 +9711,11 @@
     "name": "firefox_addons",
     "description": "Firefox browser [add-ons](https://addons.mozilla.org/en-US/firefox/) (plugins).",
     "url": "https://fleetdm.com/tables/firefox_addons",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9441,7 +9855,9 @@
     "name": "gatekeeper",
     "description": "macOS Gatekeeper Details.",
     "url": "https://fleetdm.com/tables/gatekeeper",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9490,7 +9906,9 @@
     "name": "gatekeeper_approved_apps",
     "description": "Gatekeeper apps a user has allowed to run.",
     "url": "https://fleetdm.com/tables/gatekeeper_approved_apps",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9540,7 +9958,11 @@
     "name": "groups",
     "description": "Local system groups.",
     "url": "https://fleetdm.com/tables/groups",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* On Windows, `gid` and `gid_signed` are always the same",
@@ -9581,7 +10003,9 @@
         "hidden": false,
         "required": false,
         "index": true,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "comment",
@@ -9591,7 +10015,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "is_hidden",
@@ -9601,7 +10027,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "pid_with_namespace",
@@ -9611,7 +10039,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/groups.yml"
@@ -9620,7 +10050,10 @@
     "name": "hardware_events",
     "description": "Hardware (PCI/USB/HID) events from UDEV or IOKit.",
     "url": "https://fleetdm.com/tables/hardware_events",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -9742,7 +10175,11 @@
     "name": "hash",
     "description": "Filesystem hash data.",
     "url": "https://fleetdm.com/tables/hash",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9801,7 +10238,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -9811,7 +10250,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/hash.yml"
@@ -9820,7 +10261,9 @@
     "name": "homebrew_packages",
     "description": "The installed homebrew package database.",
     "url": "https://fleetdm.com/tables/homebrew_packages",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -9869,7 +10312,9 @@
     "name": "hvci_status",
     "description": "Retrieve HVCI info of the machine.",
     "url": "https://fleetdm.com/tables/hvci_status",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -9928,7 +10373,9 @@
     "name": "ibridge_info",
     "description": "Information about the Apple iBridge hardware controller.",
     "url": "https://fleetdm.com/tables/ibridge_info",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -9978,7 +10425,9 @@
     "name": "ie_extensions",
     "description": "Installed Internet Explorer (IE) browser extensions (plugins).",
     "url": "https://fleetdm.com/tables/ie_extensions",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -10027,7 +10476,10 @@
     "name": "intel_me_info",
     "description": "Intel ME/CSE Info.",
     "url": "https://fleetdm.com/tables/intel_me_info",
-    "platforms": ["linux", "windows"],
+    "platforms": [
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -10050,7 +10502,11 @@
     "name": "interface_addresses",
     "description": "Network interfaces and relevant metadata.",
     "url": "https://fleetdm.com/tables/interface_addresses",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -10118,7 +10574,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_addresses.yml"
@@ -10127,7 +10585,11 @@
     "name": "interface_details",
     "description": "Detailed information and stats of network interfaces.",
     "url": "https://fleetdm.com/tables/interface_details",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -10289,7 +10751,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux", "macOS"]
+        "platforms": [
+          "Linux",
+          "macOS"
+        ]
       },
       {
         "name": "pci_slot",
@@ -10299,7 +10764,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "friendly_name",
@@ -10309,7 +10776,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "description",
@@ -10319,7 +10788,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "manufacturer",
@@ -10329,7 +10800,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "connection_id",
@@ -10339,7 +10812,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "connection_status",
@@ -10349,7 +10824,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "enabled",
@@ -10359,7 +10836,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "physical_adapter",
@@ -10369,7 +10848,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "speed",
@@ -10379,7 +10860,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "service",
@@ -10389,7 +10872,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dhcp_enabled",
@@ -10399,7 +10884,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dhcp_lease_expires",
@@ -10409,7 +10896,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dhcp_lease_obtained",
@@ -10419,7 +10908,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dhcp_server",
@@ -10429,7 +10920,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dns_domain",
@@ -10439,7 +10932,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dns_domain_suffix_search_order",
@@ -10449,7 +10944,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dns_host_name",
@@ -10459,7 +10956,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "dns_server_search_order",
@@ -10469,7 +10968,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_details.yml"
@@ -10478,7 +10979,10 @@
     "name": "interface_ipv6",
     "description": "IPv6 configuration and stats of network interfaces.",
     "url": "https://fleetdm.com/tables/interface_ipv6",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -10536,7 +11040,9 @@
     "name": "iokit_devicetree",
     "description": "The IOKit registry matching the DeviceTree plane.",
     "url": "https://fleetdm.com/tables/iokit_devicetree",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -10630,7 +11136,9 @@
     "name": "iokit_registry",
     "description": "The full IOKit registry without selecting a plane.",
     "url": "https://fleetdm.com/tables/iokit_registry",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -10706,7 +11214,9 @@
     "name": "iptables",
     "description": "Linux IP packet filtering and NAT tool.",
     "url": "https://fleetdm.com/tables/iptables",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -10882,7 +11392,9 @@
     "name": "kernel_extensions",
     "description": "macOS's kernel extensions, both loaded and within the load search path.",
     "url": "https://fleetdm.com/tables/kernel_extensions",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -10958,7 +11470,11 @@
     "name": "kernel_info",
     "description": "Basic active kernel information.",
     "url": "https://fleetdm.com/tables/kernel_info",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -11007,7 +11523,9 @@
     "name": "kernel_keys",
     "description": "List of security data, authentication keys and encryption keys.",
     "url": "https://fleetdm.com/tables/kernel_keys",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -11102,7 +11620,9 @@
     "name": "kernel_modules",
     "description": "Linux kernel modules both loaded and within the load search path.",
     "url": "https://fleetdm.com/tables/kernel_modules",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -11161,7 +11681,9 @@
     "name": "kernel_panics",
     "description": "System kernel panic logs.",
     "url": "https://fleetdm.com/tables/kernel_panics",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -11291,7 +11813,9 @@
     "name": "keychain_acls",
     "description": "Applications that have ACL entries in the keychain.",
     "url": "https://fleetdm.com/tables/keychain_acls",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -11349,7 +11873,9 @@
     "name": "keychain_items",
     "description": "Generic details about keychain items.",
     "url": "https://fleetdm.com/tables/keychain_items",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -11434,11 +11960,16 @@
     "name": "known_hosts",
     "description": "A line-delimited known_hosts table.",
     "url": "https://fleetdm.com/tables/known_hosts",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
-    "examples": ["select * from users join known_hosts using (uid)"],
+    "examples": [
+      "select * from users join known_hosts using (uid)"
+    ],
     "columns": [
       {
         "name": "uid",
@@ -11475,7 +12006,9 @@
     "name": "kva_speculative_info",
     "description": "Display kernel virtual address and speculative execution information for the system.",
     "url": "https://fleetdm.com/tables/kva_speculative_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -11588,7 +12121,10 @@
     "name": "last",
     "description": "System logins and logouts.",
     "url": "https://fleetdm.com/tables/last",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -11664,7 +12200,9 @@
     "name": "launchd",
     "description": "LaunchAgents and LaunchDaemons from default search paths.",
     "url": "https://fleetdm.com/tables/launchd",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -11866,7 +12404,9 @@
     "name": "launchd_overrides",
     "description": "Override keys, per user, for LaunchDaemons and Agents.",
     "url": "https://fleetdm.com/tables/launchd_overrides",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -11925,7 +12465,11 @@
     "name": "listening_ports",
     "description": "Processes with listening (bound) network sockets/ports.",
     "url": "https://fleetdm.com/tables/listening_ports",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -12011,7 +12555,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/listening_ports.yml"
@@ -12020,7 +12566,10 @@
     "name": "load_average",
     "description": "Displays information about the system wide load averages.",
     "url": "https://fleetdm.com/tables/load_average",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12051,7 +12600,9 @@
     "name": "location_services",
     "description": "Reports the status of the Location Services feature of the OS.",
     "url": "https://fleetdm.com/tables/location_services",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12073,7 +12624,11 @@
     "name": "logged_in_users",
     "description": "Users with an active shell on the system.",
     "url": "https://fleetdm.com/tables/logged_in_users",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -12141,7 +12696,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "registry_hive",
@@ -12151,7 +12708,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/logged_in_users.yml"
@@ -12160,7 +12719,9 @@
     "name": "logical_drives",
     "description": "Details for logical drives on the system. A logical drive generally represents a single partition.",
     "url": "https://fleetdm.com/tables/logical_drives",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12237,7 +12798,9 @@
     "name": "logon_sessions",
     "description": "Windows Logon Session.",
     "url": "https://fleetdm.com/tables/logon_sessions",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12386,7 +12949,9 @@
     "name": "lxd_certificates",
     "description": "LXD certificates information.",
     "url": "https://fleetdm.com/tables/lxd_certificates",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12436,7 +13001,9 @@
     "name": "lxd_cluster",
     "description": "LXD cluster information.",
     "url": "https://fleetdm.com/tables/lxd_cluster",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12513,7 +13080,9 @@
     "name": "lxd_cluster_members",
     "description": "LXD cluster members information.",
     "url": "https://fleetdm.com/tables/lxd_cluster_members",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12572,7 +13141,9 @@
     "name": "lxd_images",
     "description": "LXD images information.",
     "url": "https://fleetdm.com/tables/lxd_images",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12757,7 +13328,9 @@
     "name": "lxd_instance_config",
     "description": "LXD instance configuration information.",
     "url": "https://fleetdm.com/tables/lxd_instance_config",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12798,7 +13371,9 @@
     "name": "lxd_instance_devices",
     "description": "LXD instance devices information.",
     "url": "https://fleetdm.com/tables/lxd_instance_devices",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12857,7 +13432,9 @@
     "name": "lxd_instances",
     "description": "LXD instances information.",
     "url": "https://fleetdm.com/tables/lxd_instances",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -12970,7 +13547,9 @@
     "name": "lxd_networks",
     "description": "LXD network information.",
     "url": "https://fleetdm.com/tables/lxd_networks",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13101,7 +13680,9 @@
     "name": "lxd_storage_pools",
     "description": "LXD storage pool information.",
     "url": "https://fleetdm.com/tables/lxd_storage_pools",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13187,7 +13768,10 @@
     "name": "magic",
     "description": "Magic number recognition library table.",
     "url": "https://fleetdm.com/tables/magic",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13246,7 +13830,9 @@
     "name": "managed_policies",
     "description": "The managed configuration policies from AD, MDM, MCX, etc.",
     "url": "https://fleetdm.com/tables/managed_policies",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13313,7 +13899,9 @@
     "name": "md_devices",
     "description": "Software RAID array settings.",
     "url": "https://fleetdm.com/tables/md_devices",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13606,7 +14194,9 @@
     "name": "md_drives",
     "description": "Drive devices used for Software RAID.",
     "url": "https://fleetdm.com/tables/md_drives",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13656,7 +14246,9 @@
     "name": "md_personalities",
     "description": "Software RAID setting supported by the kernel.",
     "url": "https://fleetdm.com/tables/md_personalities",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13679,7 +14271,9 @@
     "name": "mdfind",
     "description": "Run searches against the spotlight database.",
     "url": "https://fleetdm.com/tables/mdfind",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13711,7 +14305,9 @@
     "name": "mdls",
     "description": "Query file metadata in the Spotlight database.",
     "url": "https://fleetdm.com/tables/mdls",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13760,7 +14356,10 @@
     "name": "memory_array_mapped_addresses",
     "description": "Data associated for address mapping of physical memory arrays.",
     "url": "https://fleetdm.com/tables/memory_array_mapped_addresses",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13819,7 +14418,10 @@
     "name": "memory_arrays",
     "description": "Data associated with collection of memory devices that operate to form a memory address.",
     "url": "https://fleetdm.com/tables/memory_arrays",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13896,7 +14498,10 @@
     "name": "memory_device_mapped_addresses",
     "description": "Data associated for address mapping of physical memory devices.",
     "url": "https://fleetdm.com/tables/memory_device_mapped_addresses",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -13982,7 +14587,11 @@
     "name": "memory_devices",
     "description": "Physical memory device (type 17) information retrieved from SMBIOS.",
     "url": "https://fleetdm.com/tables/memory_devices",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14176,7 +14785,10 @@
     "name": "memory_error_info",
     "description": "Data associated with errors of a physical memory array.",
     "url": "https://fleetdm.com/tables/memory_error_info",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14262,7 +14874,9 @@
     "name": "memory_info",
     "description": "Main memory information in bytes.",
     "url": "https://fleetdm.com/tables/memory_info",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14366,7 +14980,9 @@
     "name": "memory_map",
     "description": "OS memory region map.",
     "url": "https://fleetdm.com/tables/memory_map",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14407,7 +15023,10 @@
     "name": "mounts",
     "description": "System mounted devices and filesystems (not process specific).",
     "url": "https://fleetdm.com/tables/mounts",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14519,7 +15138,9 @@
     "name": "msr",
     "description": "Various pieces of data stored in the model specific register per processor. NOTE: the msr kernel module must be enabled, and osquery must be run as root.",
     "url": "https://fleetdm.com/tables/msr",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14623,7 +15244,9 @@
     "name": "nfs_shares",
     "description": "NFS shares exported by the host.",
     "url": "https://fleetdm.com/tables/nfs_shares",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14663,7 +15286,11 @@
     "name": "npm_packages",
     "description": "Node packages installed in a system.",
     "url": "https://fleetdm.com/tables/npm_packages",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14749,7 +15376,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -14759,7 +15388,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/npm_packages.yml"
@@ -14768,7 +15399,9 @@
     "name": "ntdomains",
     "description": "Display basic NT domain information of a Windows machine.",
     "url": "https://fleetdm.com/tables/ntdomains",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14853,7 +15486,9 @@
     "name": "ntfs_acl_permissions",
     "description": "Retrieve NTFS ACL permission information for files and directories.",
     "url": "https://fleetdm.com/tables/ntfs_acl_permissions",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -14912,7 +15547,9 @@
     "name": "ntfs_journal_events",
     "description": "Track time/action changes to files specified in configuration data.",
     "url": "https://fleetdm.com/tables/ntfs_journal_events",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -15043,7 +15680,9 @@
     "name": "nvram",
     "description": "Apple NVRAM variable listing.",
     "url": "https://fleetdm.com/tables/nvram",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15083,7 +15722,10 @@
     "name": "oem_strings",
     "description": "OEM defined strings retrieved from SMBIOS.",
     "url": "https://fleetdm.com/tables/oem_strings",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15124,7 +15766,9 @@
     "name": "office_mru",
     "description": "View recently opened Office documents.",
     "url": "https://fleetdm.com/tables/office_mru",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15183,7 +15827,12 @@
     "name": "os_version",
     "description": "A single row containing the operating system name and version.",
     "url": "https://fleetdm.com/tables/os_version",
-    "platforms": ["darwin", "linux", "windows", "chrome"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15287,7 +15936,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "pid_with_namespace",
@@ -15297,7 +15948,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -15307,7 +15960,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/os_version.yml"
@@ -15316,7 +15971,11 @@
     "name": "osquery_events",
     "description": "Information about the event publishers and subscribers.",
     "url": "https://fleetdm.com/tables/osquery_events",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15392,7 +16051,11 @@
     "name": "osquery_extensions",
     "description": "List of active osquery extensions.",
     "url": "https://fleetdm.com/tables/osquery_extensions",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15459,7 +16122,11 @@
     "name": "osquery_flags",
     "description": "Configurable flags that modify osquery's behavior.",
     "url": "https://fleetdm.com/tables/osquery_flags",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15526,7 +16193,12 @@
     "name": "osquery_info",
     "description": "Top level information about the running version of osquery.",
     "url": "https://fleetdm.com/tables/osquery_info",
-    "platforms": ["darwin", "windows", "linux", "chrome"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15540,7 +16212,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "uuid",
@@ -15550,7 +16226,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "instance_id",
@@ -15560,7 +16240,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "version",
@@ -15579,7 +16263,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "config_valid",
@@ -15589,7 +16277,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "extensions",
@@ -15626,7 +16318,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "watcher",
@@ -15636,7 +16332,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "platform_mask",
@@ -15646,7 +16346,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_info.yml"
@@ -15655,7 +16359,11 @@
     "name": "osquery_packs",
     "description": "Information about the current query packs that are loaded in osquery.",
     "url": "https://fleetdm.com/tables/osquery_packs",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15731,7 +16439,11 @@
     "name": "osquery_registry",
     "description": "List the osquery registry plugins.",
     "url": "https://fleetdm.com/tables/osquery_registry",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15789,7 +16501,11 @@
     "name": "osquery_schedule",
     "description": "Information about the current queries that are scheduled in osquery.",
     "url": "https://fleetdm.com/tables/osquery_schedule",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -15946,7 +16662,9 @@
     "name": "package_bom",
     "description": "macOS package bill of materials (BOM) file list.",
     "url": "https://fleetdm.com/tables/package_bom",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16022,7 +16740,9 @@
     "name": "package_install_history",
     "description": "macOS package install history.",
     "url": "https://fleetdm.com/tables/package_install_history",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16089,7 +16809,9 @@
     "name": "package_receipts",
     "description": "macOS package receipt details.",
     "url": "https://fleetdm.com/tables/package_receipts",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16165,7 +16887,9 @@
     "name": "password_policy",
     "description": "Password Policies for macOS.",
     "url": "https://fleetdm.com/tables/password_policy",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16214,7 +16938,9 @@
     "name": "patches",
     "description": "Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).",
     "url": "https://fleetdm.com/tables/patches",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16300,7 +17026,10 @@
     "name": "pci_devices",
     "description": "PCI devices active on the host system.",
     "url": "https://fleetdm.com/tables/pci_devices",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16377,7 +17106,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "pci_subclass_id",
@@ -16387,7 +17118,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "pci_subclass",
@@ -16397,7 +17130,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "subsystem_vendor_id",
@@ -16407,7 +17142,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "subsystem_vendor",
@@ -16417,7 +17154,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "subsystem_model_id",
@@ -16427,7 +17166,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "subsystem_model",
@@ -16437,7 +17178,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pci_devices.yml"
@@ -16446,7 +17189,9 @@
     "name": "physical_disk_performance",
     "description": "Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.",
     "url": "https://fleetdm.com/tables/physical_disk_performance",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16568,7 +17313,9 @@
     "name": "pipes",
     "description": "Named and Anonymous pipes.",
     "url": "https://fleetdm.com/tables/pipes",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16627,7 +17374,11 @@
     "name": "platform_info",
     "description": "Information about EFI/UEFI/ROM and platform/boot.",
     "url": "https://fleetdm.com/tables/platform_info",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16695,7 +17446,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["linux", "darwin"]
+        "platforms": [
+          "linux",
+          "darwin"
+        ]
       },
       {
         "name": "size",
@@ -16705,7 +17459,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["linux", "darwin"]
+        "platforms": [
+          "linux",
+          "darwin"
+        ]
       },
       {
         "name": "volume_size",
@@ -16715,7 +17472,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["linux", "darwin"]
+        "platforms": [
+          "linux",
+          "darwin"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/platform_info.yml"
@@ -16724,7 +17484,9 @@
     "name": "plist",
     "description": "Read and parse a plist file.",
     "url": "https://fleetdm.com/tables/plist",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16773,7 +17535,9 @@
     "name": "portage_keywords",
     "description": "A summary about portage configurations like keywords, mask and unmask.",
     "url": "https://fleetdm.com/tables/portage_keywords",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16832,7 +17596,9 @@
     "name": "portage_packages",
     "description": "List of currently installed packages.",
     "url": "https://fleetdm.com/tables/portage_packages",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16918,7 +17684,9 @@
     "name": "portage_use",
     "description": "List of enabled portage USE values for specific package.",
     "url": "https://fleetdm.com/tables/portage_use",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -16959,7 +17727,9 @@
     "name": "power_sensors",
     "description": "Machine power (currents, voltages, wattages, etc) sensors.",
     "url": "https://fleetdm.com/tables/power_sensors",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "Returns useful results on Intel Macs only.",
@@ -17008,7 +17778,9 @@
     "name": "powershell_events",
     "description": "Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.",
     "url": "https://fleetdm.com/tables/powershell_events",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -17094,7 +17866,9 @@
     "name": "preferences",
     "description": "macOS defaults and managed preferences.",
     "url": "https://fleetdm.com/tables/preferences",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "- The `value` column will be empty for keys that contain binary data.",
@@ -17171,7 +17945,9 @@
     "name": "prefetch",
     "description": "Prefetch files show metadata related to file execution.",
     "url": "https://fleetdm.com/tables/prefetch",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -17302,7 +18078,10 @@
     "name": "process_envs",
     "description": "A key/value table of environment variables for each process.",
     "url": "https://fleetdm.com/tables/process_envs",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -17342,7 +18121,9 @@
     "name": "process_etw_events",
     "description": "Windows process execution events.",
     "url": "https://fleetdm.com/tables/process_etw_events",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -17527,7 +18308,10 @@
     "name": "process_events",
     "description": "Track time/action process executions.",
     "url": "https://fleetdm.com/tables/process_events",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -17766,7 +18550,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "fsuid",
@@ -17776,7 +18562,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "suid",
@@ -17786,7 +18574,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "fsgid",
@@ -17796,7 +18586,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "sgid",
@@ -17806,7 +18598,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "syscall",
@@ -17816,7 +18610,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_events.yml"
@@ -17825,7 +18621,9 @@
     "name": "process_file_events",
     "description": "A File Integrity Monitor implementation using the audit service.",
     "url": "https://fleetdm.com/tables/process_file_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -18019,7 +18817,11 @@
     "name": "process_memory_map",
     "description": "Process memory mapped files and pseudo device/regions.",
     "url": "https://fleetdm.com/tables/process_memory_map",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18113,7 +18915,9 @@
     "name": "process_namespaces",
     "description": "Linux namespaces for processes running on the host system.",
     "url": "https://fleetdm.com/tables/process_namespaces",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18199,7 +19003,10 @@
     "name": "process_open_files",
     "description": "File descriptors for each process.",
     "url": "https://fleetdm.com/tables/process_open_files",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18239,7 +19046,9 @@
     "name": "process_open_pipes",
     "description": "Pipes and partner processes for each process.",
     "url": "https://fleetdm.com/tables/process_open_pipes",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18325,7 +19134,11 @@
     "name": "process_open_sockets",
     "description": "Processes which have open network sockets on the system.",
     "url": "https://fleetdm.com/tables/process_open_sockets",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18429,7 +19242,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows", "Linux", "macOS"]
+        "platforms": [
+          "Windows",
+          "Linux",
+          "macOS"
+        ]
       },
       {
         "name": "net_namespace",
@@ -18439,7 +19256,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_sockets.yml"
@@ -18448,7 +19267,11 @@
     "name": "processes",
     "description": "All running processes on the host system.",
     "url": "https://fleetdm.com/tables/processes",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -18696,7 +19519,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "secure_process",
@@ -18706,7 +19531,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "protection_type",
@@ -18716,7 +19543,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "virtual_process",
@@ -18726,7 +19555,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "elapsed_time",
@@ -18736,7 +19567,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "handle_count",
@@ -18746,7 +19579,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "percent_processor_time",
@@ -18756,7 +19591,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "upid",
@@ -18766,7 +19603,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "uppid",
@@ -18776,7 +19615,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "cpu_type",
@@ -18786,7 +19627,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "cpu_subtype",
@@ -18796,7 +19639,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "translated",
@@ -18806,7 +19651,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "cgroup_path",
@@ -18816,7 +19663,9 @@
         "hidden": true,
         "required": false,
         "index": false,
-        "platforms": ["linux"]
+        "platforms": [
+          "linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/processes.yml"
@@ -18825,7 +19674,9 @@
     "name": "programs",
     "description": "Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.",
     "url": "https://fleetdm.com/tables/programs",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18920,7 +19771,10 @@
     "name": "prometheus_metrics",
     "description": "Retrieve metrics from a Prometheus server.",
     "url": "https://fleetdm.com/tables/prometheus_metrics",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -18970,7 +19824,11 @@
     "name": "python_packages",
     "description": "Python packages installed in a system.",
     "url": "https://fleetdm.com/tables/python_packages",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -19047,7 +19905,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/python_packages.yml"
@@ -19056,7 +19916,9 @@
     "name": "quicklook_cache",
     "description": "Files and thumbnails within macOS's Quicklook Cache.",
     "url": "https://fleetdm.com/tables/quicklook_cache",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -19178,7 +20040,9 @@
     "name": "registry",
     "description": "All of the Windows registry hives.",
     "url": "https://fleetdm.com/tables/registry",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -19246,7 +20110,11 @@
     "name": "routes",
     "description": "The active route table for the host system.",
     "url": "https://fleetdm.com/tables/routes",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -19341,7 +20209,10 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux", "macOS"]
+        "platforms": [
+          "Linux",
+          "macOS"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/routes.yml"
@@ -19350,7 +20221,9 @@
     "name": "rpm_package_files",
     "description": "RPM packages that are currently installed on the host system.",
     "url": "https://fleetdm.com/tables/rpm_package_files",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -19427,7 +20300,9 @@
     "name": "rpm_packages",
     "description": "RPM packages that are currently installed on the host system.",
     "url": "https://fleetdm.com/tables/rpm_packages",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -19540,7 +20415,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "mount_namespace_id",
@@ -19550,7 +20427,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/rpm_packages.yml"
@@ -19559,7 +20438,9 @@
     "name": "running_apps",
     "description": "macOS applications currently running on the host system.",
     "url": "https://fleetdm.com/tables/running_apps",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -19599,7 +20480,9 @@
     "name": "safari_extensions",
     "description": "Installed Safari browser extensions (plugins).",
     "url": "https://fleetdm.com/tables/safari_extensions",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "- Includes installed extensions for all system users.",
@@ -19705,7 +20588,9 @@
     "name": "sandboxes",
     "description": "macOS application sandboxes container details.",
     "url": "https://fleetdm.com/tables/sandboxes",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -19773,7 +20658,9 @@
     "name": "scheduled_tasks",
     "description": "Lists all of the tasks in the Windows task scheduler.",
     "url": "https://fleetdm.com/tables/scheduled_tasks",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -19877,10 +20764,13 @@
     "name": "screenlock",
     "description": "Returns if the screen locks automatically and the time, in seconds, it takes until the screen is locked automatically while idle.  For macOS, this table will return no results if osquery is running as root.",
     "url": "https://fleetdm.com/tables/screenlock",
-    "platforms": ["darwin", "chrome"],
+    "platforms": [
+      "darwin",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
-    "notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in.\n- For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension.  Available for Chrome 73+.",
+    "notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in. - For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 73+.",
     "examples": [],
     "columns": [
       {
@@ -19908,7 +20798,9 @@
     "name": "seccomp_events",
     "description": "A virtual table that tracks seccomp events.",
     "url": "https://fleetdm.com/tables/seccomp_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -20057,7 +20949,11 @@
     "name": "secureboot",
     "description": "Secure Boot UEFI Settings.",
     "url": "https://fleetdm.com/tables/secureboot",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20080,7 +20976,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["darwin"]
+        "platforms": [
+          "darwin"
+        ]
       },
       {
         "name": "setup_mode",
@@ -20090,7 +20988,12 @@
         "hidden": true,
         "required": false,
         "index": false,
-        "platforms": ["linux", "windows", "win32", "cygwin"]
+        "platforms": [
+          "linux",
+          "windows",
+          "win32",
+          "cygwin"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml"
@@ -20099,7 +21002,9 @@
     "name": "security_profile_info",
     "description": "Information on the security profile of a given system by listing the system Account and Audit Policies. This table mimics the exported securitypolicy output from the secedit tool.",
     "url": "https://fleetdm.com/tables/security_profile_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20320,7 +21225,9 @@
     "name": "selinux_events",
     "description": "Track SELinux events.",
     "url": "https://fleetdm.com/tables/selinux_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -20379,7 +21286,9 @@
     "name": "selinux_settings",
     "description": "Track active SELinux settings.",
     "url": "https://fleetdm.com/tables/selinux_settings",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20420,7 +21329,9 @@
     "name": "services",
     "description": "Lists all installed Windows services and their relevant data.",
     "url": "https://fleetdm.com/tables/services",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20542,7 +21453,9 @@
     "name": "shadow",
     "description": "Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.",
     "url": "https://fleetdm.com/tables/shadow",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20646,7 +21559,9 @@
     "name": "shared_folders",
     "description": "Folders available to others via SMB or AFP.",
     "url": "https://fleetdm.com/tables/shared_folders",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20677,7 +21592,9 @@
     "name": "shared_memory",
     "description": "OS shared memory regions.",
     "url": "https://fleetdm.com/tables/shared_memory",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -20808,7 +21725,9 @@
     "name": "shared_resources",
     "description": "Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.",
     "url": "https://fleetdm.com/tables/shared_resources",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* `type_name` is a human readable value of the type column. These values can include: \"Disk Drive Admin\", \"IPC Admin\", \"Disk Drive\"",
@@ -20902,7 +21821,9 @@
     "name": "sharing_preferences",
     "description": "macOS Sharing preferences.",
     "url": "https://fleetdm.com/tables/sharing_preferences",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21005,7 +21926,10 @@
     "name": "shell_history",
     "description": "A line-delimited (command) table of per-user .*_history data.",
     "url": "https://fleetdm.com/tables/shell_history",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21055,7 +21979,9 @@
     "name": "shellbags",
     "description": "Shows directories accessed via Windows Explorer.",
     "url": "https://fleetdm.com/tables/shellbags",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21141,7 +22067,9 @@
     "name": "shimcache",
     "description": "Application Compatibility Cache, contains artifacts of execution.",
     "url": "https://fleetdm.com/tables/shimcache",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "\nSome key caveats to know about this data source:\n* Process execution logs are only written during a reboot, otherwise they are stored in memory. This means you may not be seeing the data you would expect if the system hasn't been rebooted recently.\n* The entry column shows the order of execution - Starting from 1, which is the most-recent process execution, and then on from there.\n* The modified_time column displays the last modified time for the file.\nSource: https://bromiley.medium.com/windows-wednesday-shim-cache-1997ba8b13e7",
@@ -21190,7 +22118,9 @@
     "name": "signature",
     "description": "File (executable, bundle, installer, disk) code signing status.",
     "url": "https://fleetdm.com/tables/signature",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21275,7 +22205,9 @@
     "name": "sip_config",
     "description": "Apple's System Integrity Protection (rootless) status.",
     "url": "https://fleetdm.com/tables/sip_config",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21315,7 +22247,10 @@
     "name": "smbios_tables",
     "description": "BIOS (DMI) structure common details and content.",
     "url": "https://fleetdm.com/tables/smbios_tables",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "This table requires an Intel compatible system.",
@@ -21391,7 +22326,9 @@
     "name": "smc_keys",
     "description": "Apple's system management controller keys.",
     "url": "https://fleetdm.com/tables/smc_keys",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21449,7 +22386,10 @@
     "name": "socket_events",
     "description": "Track network socket opens and closes.",
     "url": "https://fleetdm.com/tables/socket_events",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -21616,7 +22556,11 @@
     "name": "ssh_configs",
     "description": "A table of parsed ssh_configs.",
     "url": "https://fleetdm.com/tables/ssh_configs",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21666,7 +22610,11 @@
     "name": "startup_items",
     "description": "Applications and binaries set as user/login startup items.",
     "url": "https://fleetdm.com/tables/startup_items",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -21742,7 +22690,10 @@
     "name": "sudoers",
     "description": "Rules for running commands as other users via sudo.",
     "url": "https://fleetdm.com/tables/sudoers",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21782,7 +22733,10 @@
     "name": "suid_bin",
     "description": "suid binaries in common locations.",
     "url": "https://fleetdm.com/tables/suid_bin",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -21832,7 +22786,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/suid_bin.yml"
@@ -21841,7 +22797,9 @@
     "name": "syslog_events",
     "description": "",
     "url": "https://fleetdm.com/tables/syslog_events",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -21927,7 +22885,10 @@
     "name": "system_controls",
     "description": "sysctl names, values, and settings information.",
     "url": "https://fleetdm.com/tables/system_controls",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -21995,7 +22956,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_controls.yml"
@@ -22004,7 +22967,9 @@
     "name": "system_extensions",
     "description": "macOS (>= 10.15) system extension table.",
     "url": "https://fleetdm.com/tables/system_extensions",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22098,7 +23063,12 @@
     "name": "system_info",
     "description": "System information for identification.",
     "url": "https://fleetdm.com/tables/system_info",
-    "platforms": ["windows", "darwin", "linux", "chrome"],
+    "platforms": [
+      "windows",
+      "darwin",
+      "linux",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22139,7 +23109,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "cpu_brand",
@@ -22158,7 +23132,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "cpu_logical_cores",
@@ -22168,7 +23146,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "cpu_microcode",
@@ -22178,7 +23160,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "physical_memory",
@@ -22215,7 +23201,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "hardware_serial",
@@ -22234,7 +23224,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "board_model",
@@ -22244,7 +23238,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "board_version",
@@ -22254,7 +23252,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "board_serial",
@@ -22264,7 +23266,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "computer_name",
@@ -22283,7 +23289,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_info.yml"
@@ -22292,7 +23302,9 @@
     "name": "systemd_units",
     "description": "Track systemd units.",
     "url": "https://fleetdm.com/tables/systemd_units",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22432,7 +23444,9 @@
     "name": "temperature_sensors",
     "description": "Machine's temperature sensors.",
     "url": "https://fleetdm.com/tables/temperature_sensors",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22481,7 +23495,11 @@
     "name": "time",
     "description": "Track current date and time in UTC.",
     "url": "https://fleetdm.com/tables/time",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22612,7 +23630,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time.yml"
@@ -22621,7 +23641,9 @@
     "name": "time_machine_backups",
     "description": "Backups to drives using TimeMachine.",
     "url": "https://fleetdm.com/tables/time_machine_backups",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22652,7 +23674,9 @@
     "name": "time_machine_destinations",
     "description": "Locations backed up to using Time Machine.",
     "url": "https://fleetdm.com/tables/time_machine_destinations",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22728,7 +23752,9 @@
     "name": "tpm_info",
     "description": "A table that lists the TPM related information.",
     "url": "https://fleetdm.com/tables/tpm_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22823,7 +23849,10 @@
     "name": "ulimit_info",
     "description": "System resource usage limits.",
     "url": "https://fleetdm.com/tables/ulimit_info",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22863,7 +23892,9 @@
     "name": "unified_log",
     "description": "Queries the OSLog framework for entries in the system log. The maximum number of rows returned is limited for performance issues. This table introduces a new idiom for extracting sequential data in batches using multiple queries, ordered by timestamp. To trigger it, the user should include the condition \"timestamp > -1\", and the table will handle pagination.",
     "url": "https://fleetdm.com/tables/unified_log",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -22985,7 +24016,11 @@
     "name": "uptime",
     "description": "Track time passed since last boot. Some systems track this as calendar time, some as runtime.",
     "url": "https://fleetdm.com/tables/uptime",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23043,7 +24078,10 @@
     "name": "usb_devices",
     "description": "USB devices that are actively plugged into the host system.",
     "url": "https://fleetdm.com/tables/usb_devices",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23164,7 +24202,10 @@
     "name": "user_events",
     "description": "Track user events from the audit framework.",
     "url": "https://fleetdm.com/tables/user_events",
-    "platforms": ["darwin", "linux"],
+    "platforms": [
+      "darwin",
+      "linux"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -23277,7 +24318,11 @@
     "name": "user_groups",
     "description": "Local system user group relationships.",
     "url": "https://fleetdm.com/tables/user_groups",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23309,7 +24354,9 @@
     "name": "user_interaction_events",
     "description": "Track user interaction events from macOS' event tapping framework.",
     "url": "https://fleetdm.com/tables/user_interaction_events",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -23332,7 +24379,11 @@
     "name": "user_ssh_keys",
     "description": "Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.",
     "url": "https://fleetdm.com/tables/user_ssh_keys",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23383,7 +24434,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_ssh_keys.yml"
@@ -23392,7 +24445,9 @@
     "name": "userassist",
     "description": "UserAssist Registry Key tracks when a user executes an application from Windows Explorer.",
     "url": "https://fleetdm.com/tables/userassist",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23441,7 +24496,12 @@
     "name": "users",
     "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).",
     "url": "https://fleetdm.com/tables/users",
-    "platforms": ["darwin", "windows", "linux", "chrome"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux",
+      "chrome"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23464,7 +24524,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "uid_signed",
@@ -23474,7 +24538,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "gid_signed",
@@ -23484,7 +24552,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "username",
@@ -23503,7 +24575,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "directory",
@@ -23513,7 +24589,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "shell",
@@ -23523,7 +24603,11 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS", "Windows", "Linux"]
+        "platforms": [
+          "macOS",
+          "Windows",
+          "Linux"
+        ]
       },
       {
         "name": "uuid",
@@ -23542,7 +24626,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Windows"]
+        "platforms": [
+          "Windows"
+        ]
       },
       {
         "name": "is_hidden",
@@ -23552,7 +24638,9 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["macOS"]
+        "platforms": [
+          "macOS"
+        ]
       },
       {
         "name": "pid_with_namespace",
@@ -23562,14 +24650,18 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       },
       {
         "name": "email",
         "required": false,
         "type": "string",
         "description": "Email",
-        "platforms": ["chrome"]
+        "platforms": [
+          "chrome"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/users.yml"
@@ -23578,7 +24670,9 @@
     "name": "video_info",
     "description": "Retrieve video card information of the machine.",
     "url": "https://fleetdm.com/tables/video_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23664,7 +24758,9 @@
     "name": "virtual_memory_info",
     "description": "Darwin Virtual Memory statistics.",
     "url": "https://fleetdm.com/tables/virtual_memory_info",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -23875,7 +24971,9 @@
     "name": "wifi_networks",
     "description": "Wi-Fi networks previously connected to by this Mac, or that are otherwise in this computer's known/remembered Wi-Fi networks list.",
     "url": "https://fleetdm.com/tables/wifi_networks",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -24050,7 +25148,9 @@
     "name": "wifi_status",
     "description": "macOS current WiFi status.",
     "url": "https://fleetdm.com/tables/wifi_status",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "- `bssid` and `country code` are only available for macOS 11 and earlier because they would enable geolocation. ",
@@ -24180,7 +25280,9 @@
     "name": "wifi_survey",
     "description": "Scan for nearby WiFi networks.",
     "url": "https://fleetdm.com/tables/wifi_survey",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "- `bssid` and `country code` are only available for macOS 11 and earlier because they would enable geolocation. ",
@@ -24283,7 +25385,9 @@
     "name": "winbaseobj",
     "description": "Lists named Windows objects in the default object directories, across all terminal services sessions.  Example Windows ojbect types include Mutexes, Events, Jobs and Semaphors.",
     "url": "https://fleetdm.com/tables/winbaseobj",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -24324,7 +25428,9 @@
     "name": "windows_crashes",
     "description": "Extracted information from Windows crash logs (Minidumps).",
     "url": "https://fleetdm.com/tables/windows_crashes",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -24527,7 +25633,9 @@
     "name": "windows_eventlog",
     "description": "Table for querying all recorded Windows event logs.",
     "url": "https://fleetdm.com/tables/windows_eventlog",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs. \n* The information returned in the `data` column will be JSON formatted, which will require additional parsing.  ",
@@ -24675,7 +25783,9 @@
     "name": "windows_events",
     "description": "Windows Event logs.",
     "url": "https://fleetdm.com/tables/windows_events",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -24797,7 +25907,9 @@
     "name": "windows_firewall_rules",
     "description": "Provides the list of Windows firewall rules.",
     "url": "https://fleetdm.com/tables/windows_firewall_rules",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "* A rule can exist, but it has to be part of the currently enabled firewall profile to be enforced.",
@@ -24954,7 +26066,9 @@
     "name": "windows_optional_features",
     "description": "Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.",
     "url": "https://fleetdm.com/tables/windows_optional_features",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25003,7 +26117,9 @@
     "name": "windows_security_center",
     "description": "The health status of Window Security features. Health values can be \"Good\", \"Poor\". \"Snoozed\", \"Not Monitored\", and \"Error\".",
     "url": "https://fleetdm.com/tables/windows_security_center",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25080,7 +26196,9 @@
     "name": "windows_security_products",
     "description": "Enumeration of registered Windows security products. Note: Not compatible with Windows Server.",
     "url": "https://fleetdm.com/tables/windows_security_products",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25148,7 +26266,9 @@
     "name": "windows_update_history",
     "description": "Provides the history of the windows update events.",
     "url": "https://fleetdm.com/tables/windows_update_history",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25270,7 +26390,9 @@
     "name": "wmi_bios_info",
     "description": "Lists important information from the system bios.",
     "url": "https://fleetdm.com/tables/wmi_bios_info",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25302,7 +26424,9 @@
     "name": "wmi_cli_event_consumers",
     "description": "WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.",
     "url": "https://fleetdm.com/tables/wmi_cli_event_consumers",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25361,7 +26485,9 @@
     "name": "wmi_event_filters",
     "description": "Lists WMI event filters.",
     "url": "https://fleetdm.com/tables/wmi_event_filters",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25420,7 +26546,9 @@
     "name": "wmi_filter_consumer_binding",
     "description": "Lists the relationship between event consumers and filters.",
     "url": "https://fleetdm.com/tables/wmi_filter_consumer_binding",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25470,7 +26598,9 @@
     "name": "wmi_script_event_consumers",
     "description": "WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.",
     "url": "https://fleetdm.com/tables/wmi_script_event_consumers",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25538,7 +26668,9 @@
     "name": "xprotect_entries",
     "description": "Database of the machine's XProtect signatures.",
     "url": "https://fleetdm.com/tables/xprotect_entries",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -25614,7 +26746,9 @@
     "name": "xprotect_meta",
     "description": "This Mac's browser-related [XProtect](https://support.apple.com/en-ca/guide/security/sec469d47bd8/web) signatures.",
     "url": "https://fleetdm.com/tables/xprotect_meta",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -25663,10 +26797,12 @@
     "name": "xprotect_reports",
     "description": "Database of XProtect matches (if user generated/sent an XProtect report).",
     "url": "https://fleetdm.com/tables/xprotect_reports",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "cacheable": false,
-    "notes": "",
+    "notes": "- In [very specific circumstances](https://github.com/osquery/osquery/issues/6588#issuecomment-1410934706) this table will return empty because xprotect will detect and remediate without generating an eicar file. \n",
     "examples": "See all Xprotect activity reports, if any are present. This indicates potentially malicious software was blocked by Xprotect.\n```\nSELECT * FROM xprotect_reports;\n```",
     "columns": [
       {
@@ -25703,7 +26839,11 @@
     "name": "yara",
     "description": "Triggers one-off YARA query for files at the specified path. Requires one of `sig_group`, `sigfile`, or `sigrule`.",
     "url": "https://fleetdm.com/tables/yara",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -25798,7 +26938,9 @@
         "hidden": true,
         "required": false,
         "index": false,
-        "platforms": ["linux"]
+        "platforms": [
+          "linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara.yml"
@@ -25807,7 +26949,11 @@
     "name": "yara_events",
     "description": "Track YARA matches for files specified in configuration data.",
     "url": "https://fleetdm.com/tables/yara_events",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": true,
     "cacheable": false,
     "notes": "",
@@ -25911,7 +27057,11 @@
     "name": "ycloud_instance_metadata",
     "description": "Yandex.Cloud instance metadata.",
     "url": "https://fleetdm.com/tables/ycloud_instance_metadata",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "evented": false,
     "cacheable": true,
     "notes": "",
@@ -26006,7 +27156,9 @@
     "name": "yum_sources",
     "description": "Current list of Yum repositories or software channels.",
     "url": "https://fleetdm.com/tables/yum_sources",
-    "platforms": ["linux"],
+    "platforms": [
+      "linux"
+    ],
     "evented": false,
     "cacheable": false,
     "notes": "",
@@ -26074,14 +27226,18 @@
         "hidden": false,
         "required": false,
         "index": false,
-        "platforms": ["Linux"]
+        "platforms": [
+          "Linux"
+        ]
       }
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml"
   },
   {
     "name": "apfs_physical_stores",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Information about APFS physical stores from the `diskutil apfs list -plist` command.",
     "columns": [
       {
@@ -26146,7 +27302,9 @@
   },
   {
     "name": "apfs_volumes",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Information about APFS volumes from the `diskutil apfs list -plist` command.",
     "columns": [
       {
@@ -26259,7 +27417,9 @@
   },
   {
     "name": "authdb",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Returns JSON output for the `authorizationdb read <right_name>` command.",
     "columns": [
       {
@@ -26282,7 +27442,9 @@
   },
   {
     "name": "cis_audit",
-    "platforms": ["windows"],
+    "platforms": [
+      "windows"
+    ],
     "description": "Enables querying CIS items values.",
     "columns": [
       {
@@ -26303,128 +27465,11 @@
     "url": "https://fleetdm.com/tables/cis_audit",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cis_audit.yml"
   },
-  {
-    "name": "corestorage_logical_volume_families",
-    "platforms": ["darwin"],
-    "description": "Information about CoreStorage Logical Volume Families from the `diskutil coreStorage list -plist` command.",
-    "columns": [
-      {
-        "name": "vg_UUID",
-        "type": "text",
-        "required": false,
-        "description": "The unique identifier of the containing volume group"
-      },
-      {
-        "name": "vg_Version",
-        "type": "integer",
-        "required": false,
-        "description": "The version of the volume group, probably 1"
-      },
-      {
-        "name": "vg_FreeSpace",
-        "type": "bigint",
-        "required": false,
-        "description": "Amount of space, in bytes, in the volume group that have not been allocated by any logical volume\n"
-      },
-      {
-        "name": "vg_FusionDrive",
-        "type": "integer",
-        "required": false,
-        "description": "Whether the volume group is a \"fusion drive\" (i.e. SSHD)"
-      },
-      {
-        "name": "vg_Name",
-        "type": "text",
-        "required": false,
-        "description": "The customizable name of the volume group"
-      },
-      {
-        "name": "vg_Sequence",
-        "type": "bigint",
-        "required": false,
-        "description": "Current sequence number of the volume group"
-      },
-      {
-        "name": "vg_Size",
-        "type": "bigint",
-        "required": false,
-        "description": "Total (i.e. either allocated or unallocated) size of the volume group"
-      },
-      {
-        "name": "vg_Sparse",
-        "type": "integer",
-        "required": false,
-        "description": "Whether the volume group allows overcommitting storage"
-      },
-      {
-        "name": "vg_Status",
-        "type": "text",
-        "required": false,
-        "description": "Status of the volume group, e.g. \"Online\""
-      },
-      {
-        "name": "UUID",
-        "type": "text",
-        "required": false,
-        "description": "Unique ID of the logical volume family"
-      },
-      {
-        "name": "EncryptionStatus",
-        "type": "text",
-        "required": false,
-        "description": "Unlock status of the logical volume family, e.g. \"Locked\" or \"Unlocked\""
-      },
-      {
-        "name": "EncryptionType",
-        "type": "text",
-        "required": false,
-        "description": "Encryption algorithm for the logical volume family, normally \"AES-XTS\" or \"None\""
-      },
-      {
-        "name": "HasVisibleUsers",
-        "type": "integer",
-        "required": false,
-        "description": "Undocumented field returned from `diskutil cs info`"
-      },
-      {
-        "name": "HasVolumeKey",
-        "type": "integer",
-        "required": false,
-        "description": "Whether there is an encryption key assigned for the logical volume"
-      },
-      {
-        "name": "IsAcceptingNewUsers",
-        "type": "integer",
-        "required": false,
-        "description": "Whether new users may be granted access to the logical volume family encryption key"
-      },
-      {
-        "name": "IsFullySecure",
-        "type": "integer",
-        "required": false,
-        "description": "Undocumented field returned from `diskutil cs info`"
-      },
-      {
-        "name": "MayHaveEncryptedEvents",
-        "type": "integer",
-        "required": false,
-        "description": "Undocumented field returned from `diskutil cs info`"
-      },
-      {
-        "name": "RequiresPasswordUnlock",
-        "type": "integer",
-        "required": false,
-        "description": "Whether a password is currently required to unlock the volume"
-      }
-    ],
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "evented": false,
-    "url": "https://fleetdm.com/tables/corestorage_logical_volume_families",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volume_families.yml"
-  },
   {
     "name": "corestorage_logical_volumes",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Information about CoreStorage Logical Volumes from the `diskutil coreStorage list -plist` command.",
     "columns": [
       {
@@ -26619,9 +27664,132 @@
     "url": "https://fleetdm.com/tables/corestorage_logical_volumes",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volumes.yml"
   },
+  {
+    "name": "corestorage_logical_volume_families",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Information about CoreStorage Logical Volume Families from the `diskutil coreStorage list -plist` command.",
+    "columns": [
+      {
+        "name": "vg_UUID",
+        "type": "text",
+        "required": false,
+        "description": "The unique identifier of the containing volume group"
+      },
+      {
+        "name": "vg_Version",
+        "type": "integer",
+        "required": false,
+        "description": "The version of the volume group, probably 1"
+      },
+      {
+        "name": "vg_FreeSpace",
+        "type": "bigint",
+        "required": false,
+        "description": "Amount of space, in bytes, in the volume group that have not been allocated by any logical volume\n"
+      },
+      {
+        "name": "vg_FusionDrive",
+        "type": "integer",
+        "required": false,
+        "description": "Whether the volume group is a \"fusion drive\" (i.e. SSHD)"
+      },
+      {
+        "name": "vg_Name",
+        "type": "text",
+        "required": false,
+        "description": "The customizable name of the volume group"
+      },
+      {
+        "name": "vg_Sequence",
+        "type": "bigint",
+        "required": false,
+        "description": "Current sequence number of the volume group"
+      },
+      {
+        "name": "vg_Size",
+        "type": "bigint",
+        "required": false,
+        "description": "Total (i.e. either allocated or unallocated) size of the volume group"
+      },
+      {
+        "name": "vg_Sparse",
+        "type": "integer",
+        "required": false,
+        "description": "Whether the volume group allows overcommitting storage"
+      },
+      {
+        "name": "vg_Status",
+        "type": "text",
+        "required": false,
+        "description": "Status of the volume group, e.g. \"Online\""
+      },
+      {
+        "name": "UUID",
+        "type": "text",
+        "required": false,
+        "description": "Unique ID of the logical volume family"
+      },
+      {
+        "name": "EncryptionStatus",
+        "type": "text",
+        "required": false,
+        "description": "Unlock status of the logical volume family, e.g. \"Locked\" or \"Unlocked\""
+      },
+      {
+        "name": "EncryptionType",
+        "type": "text",
+        "required": false,
+        "description": "Encryption algorithm for the logical volume family, normally \"AES-XTS\" or \"None\""
+      },
+      {
+        "name": "HasVisibleUsers",
+        "type": "integer",
+        "required": false,
+        "description": "Undocumented field returned from `diskutil cs info`"
+      },
+      {
+        "name": "HasVolumeKey",
+        "type": "integer",
+        "required": false,
+        "description": "Whether there is an encryption key assigned for the logical volume"
+      },
+      {
+        "name": "IsAcceptingNewUsers",
+        "type": "integer",
+        "required": false,
+        "description": "Whether new users may be granted access to the logical volume family encryption key"
+      },
+      {
+        "name": "IsFullySecure",
+        "type": "integer",
+        "required": false,
+        "description": "Undocumented field returned from `diskutil cs info`"
+      },
+      {
+        "name": "MayHaveEncryptedEvents",
+        "type": "integer",
+        "required": false,
+        "description": "Undocumented field returned from `diskutil cs info`"
+      },
+      {
+        "name": "RequiresPasswordUnlock",
+        "type": "integer",
+        "required": false,
+        "description": "Whether a password is currently required to unlock the volume"
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/corestorage_logical_volume_families",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volume_families.yml"
+  },
   {
     "name": "csrutil_info",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Information from csrutil system call.",
     "columns": [
       {
@@ -26638,7 +27806,9 @@
   },
   {
     "name": "dscl",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Returns the output of the `dscl . -read` command (local domain).",
     "columns": [
       {
@@ -26671,11 +27841,41 @@
     "url": "https://fleetdm.com/tables/dscl",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml"
   },
+  {
+    "name": "filevault_users",
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
+    "platforms": [
+      "darwin"
+    ],
+    "evented": false,
+    "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
+    "columns": [
+      {
+        "name": "username",
+        "description": "Username of the FileVault user.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "uuid",
+        "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
+        "required": false,
+        "type": "text"
+      }
+    ],
+    "url": "https://fleetdm.com/tables/filevault_users",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
+  },
   {
     "name": "file_lines",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "Allows reading an arbitrary file.",
-    "platforms": ["darwin", "windows", "linux"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
     "evented": false,
     "examples": "Output the content of `/etc/hosts` line by line. \n```\nSELECT * FROM file_lines WHERE path='/etc/hosts';\n```",
     "columns": [
@@ -26697,7 +27897,9 @@
   },
   {
     "name": "filevault_prk",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Returns contents of `/var/db/FileVaultPRK.dat`.",
     "columns": [
       {
@@ -26713,56 +27915,48 @@
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml"
   },
   {
-    "name": "filevault_users",
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
-    "platforms": ["darwin"],
-    "evented": false,
-    "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
+    "name": "find_cmd",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Uses the /usr/bin/find command to list files and directories.",
     "columns": [
       {
-        "name": "username",
-        "description": "Username of the FileVault user.",
-        "required": false,
-        "type": "text"
+        "name": "directory",
+        "type": "text",
+        "required": true,
+        "description": "The directory passed to find as first argument.\n"
       },
       {
-        "name": "uuid",
-        "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
-        "required": false,
-        "type": "text"
-      }
-    ],
-    "url": "https://fleetdm.com/tables/filevault_users",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
-  },
-  {
-    "name": "firmware_eficheck_integrity_check",
-    "platforms": ["darwin"],
-    "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
-    "columns": [
-      {
-        "name": "chip",
+        "name": "type",
         "type": "text",
         "required": false,
-        "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
+        "description": "Sets the value of the `-type` flag.\n"
       },
       {
-        "name": "output",
+        "name": "perm",
         "type": "text",
         "required": false,
-        "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
+        "description": "Sets the value of the `-perm` flag.\n"
+      },
+      {
+        "name": "path",
+        "type": "text",
+        "required": false,
+        "description": "Contains the found paths.\n"
       }
     ],
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.\nFleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).\n",
     "evented": false,
-    "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
+    "url": "https://fleetdm.com/tables/find_cmd",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml"
   },
   {
     "name": "geolocation",
     "evented": false,
-    "platforms": ["chrome"],
+    "platforms": [
+      "chrome"
+    ],
     "description": "Last reported geolocation",
     "columns": [
       {
@@ -26793,11 +27987,40 @@
     "url": "https://fleetdm.com/tables/geolocation",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml"
   },
+  {
+    "name": "firmware_eficheck_integrity_check",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
+    "columns": [
+      {
+        "name": "chip",
+        "type": "text",
+        "required": false,
+        "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
+      },
+      {
+        "name": "output",
+        "type": "text",
+        "required": false,
+        "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
+  },
   {
     "name": "google_chrome_profiles",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "Profiles configured in Google Chrome.",
-    "platforms": ["darwin", "windows", "linux"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
     "evented": false,
     "examples": "List the Google Chrome accounts logged in to with `fleetdm.com` email addresses, joined to the [users](https://fleetdm.com/tables/users) table, to see the description of the operating system account that owns it.\n```\nSELECT gp.email, gp.username, u.description FROM google_chrome_profiles gp JOIN users u ON gp.username=u.username WHERE gp.email LIKE '%fleetdm.com';\n```",
     "columns": [
@@ -26831,7 +28054,9 @@
   },
   {
     "name": "icloud_private_relay",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Whether [iCloud Private Relay](https://support.apple.com/en-us/HT212614) is enabled.",
     "columns": [
       {
@@ -26850,7 +28075,9 @@
     "name": "macadmins_unified_log",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "Allows querying macOS [unified logs](https://developer.apple.com/documentation/os/logging).",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "examples": "Select the log entries that happened during the last minute and are related to `LaunchServices`. Convert the UNIX time to a human readable format,  and the signature table to verify its cryptographic signature.\n```\nSELECT u.category, u.event_message, u.process_id, datetime(u.timestamp, 'unixepoch') AS human_time, p.path, s.signed, s.identifier, s.authority FROM macadmins_unified_log u JOIN processes p ON u.process_id = p.pid JOIN signature s ON p.path = s.path WHERE u.sender_image_path LIKE '%LaunchServices%' AND last = \"1m\";\n```",
     "columns": [
@@ -26964,7 +28191,9 @@
     "name": "macos_profiles",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "High level information on installed profiles enrollment.",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "examples": "Identify all profiles that are not *verified*.\n```\nSELECT display_name, install_date FROM macos_profiles WHERE verification_state!='verified';  \n```",
     "columns": [
@@ -27024,7 +28253,9 @@
     "name": "macos_rsr",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "Returns information about installed Rapid Security Responses (RSRs).",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "columns": [
       {
@@ -27055,11 +28286,56 @@
     "url": "https://fleetdm.com/tables/macos_rsr",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml"
   },
+  {
+    "name": "mdm_bridge",
+    "platforms": [
+      "windows"
+    ],
+    "description": "Allows querying MDM enrolled devices using \"get\" commands.",
+    "columns": [
+      {
+        "name": "enrollment_status",
+        "type": "text",
+        "required": false,
+        "description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"."
+      },
+      {
+        "name": "enrolled_user",
+        "type": "text",
+        "required": false,
+        "description": "Contains the enrollment URI of the device."
+      },
+      {
+        "name": "mdm_command_input",
+        "type": "text",
+        "required": false,
+        "description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned."
+      },
+      {
+        "name": "mdm_command_output",
+        "type": "text",
+        "required": false,
+        "description": "Value of the \"Results\" field of the MDM command output."
+      },
+      {
+        "name": "raw_mdm_command_output",
+        "type": "text",
+        "required": false,
+        "description": "The full raw output of the MDM command execution."
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/mdm_bridge",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
+  },
   {
     "name": "mdm",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher). <p> Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.",
     "description": "Information on the device's MDM enrollment.",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "examples": "Identify Macs that are DEP capable but have not been enrolled to MDM.\n```\nSELECT * FROM mdm WHERE dep_capable='true' AND enrolled='false';\n```",
     "columns": [
@@ -27145,52 +28421,13 @@
     "url": "https://fleetdm.com/tables/mdm",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml"
   },
-  {
-    "name": "mdm_bridge",
-    "platforms": ["windows"],
-    "description": "Allows querying MDM enrolled devices using \"get\" commands.",
-    "columns": [
-      {
-        "name": "enrollment_status",
-        "type": "text",
-        "required": false,
-        "description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"."
-      },
-      {
-        "name": "enrolled_user",
-        "type": "text",
-        "required": false,
-        "description": "Contains the enrollment URI of the device."
-      },
-      {
-        "name": "mdm_command_input",
-        "type": "text",
-        "required": false,
-        "description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned."
-      },
-      {
-        "name": "mdm_command_output",
-        "type": "text",
-        "required": false,
-        "description": "Value of the \"Results\" field of the MDM command output."
-      },
-      {
-        "name": "raw_mdm_command_output",
-        "type": "text",
-        "required": false,
-        "description": "The full raw output of the MDM command execution."
-      }
-    ],
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "evented": false,
-    "url": "https://fleetdm.com/tables/mdm_bridge",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
-  },
   {
     "name": "munki_info",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
     "description": "Information from the last [Munki](https://github.com/munki/munki) run.",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "examples": "Output errors, warnings and problematic installations from Munki.\n```\nSELECT errors, warnings, problem_installs FROM munki_info ;\n```",
     "columns": [
@@ -27256,7 +28493,9 @@
     "name": "munki_installs",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
     "description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "evented": false,
     "examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```",
     "columns": [
@@ -27291,7 +28530,9 @@
   {
     "name": "network_interfaces",
     "evented": false,
-    "platforms": ["chrome"],
+    "platforms": [
+      "chrome"
+    ],
     "description": "Uses the `chrome.enterprise.networkingAttributes` API to read information about the host's current network.",
     "columns": [
       {
@@ -27319,7 +28560,9 @@
   },
   {
     "name": "nvram_info",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Information from nvram system call.",
     "columns": [
       {
@@ -27336,7 +28579,11 @@
   },
   {
     "name": "orbit_info",
-    "platforms": ["darwin", "linux", "windows"],
+    "platforms": [
+      "darwin",
+      "linux",
+      "windows"
+    ],
     "description": "Returns information about the orbit instance.",
     "columns": [
       {
@@ -27389,7 +28636,9 @@
   },
   {
     "name": "pmset",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Retrieves macOS power settings with the `pmset -g` command.",
     "columns": [
       {
@@ -27414,18 +28663,20 @@
     "name": "privacy_preferences",
     "notes": "This table is not a core osquery table. It is included as part of the Fleetd Chrome extension.",
     "description": "Information on Chrome features that can affect a user's privacy, available from the [chrome.privacy APIs](https://developer.chrome.com/docs/extensions/reference/privacy/)",
-    "platforms": ["chrome"],
+    "platforms": [
+      "chrome"
+    ],
     "evented": false,
     "columns": [
       {
         "name": "network_prediction_enabled",
-        "description": "1 if enabled else 0 * Available for Chrome 48+",
+        "description": "1 if enabled else 0",
         "required": false,
         "type": "integer"
       },
       {
         "name": "web_rtc_ip_handling_policy",
-        "description": "One of \"default\", \"default_public_and_private_interfaces\", \"default_public_interface_only\", or \"disable_non_proxied_udp\"",
+        "description": "One of \"default\", \"default_public_and_private_interfaces\", \"default_public_interface_only\", or \"disable_non_proxied_udp\" * Available for Chrome 48+",
         "required": false,
         "type": "text"
       },
@@ -27445,8 +28696,7 @@
         "name": "autofill_enabled",
         "description": "1 if enabled else 0 - * Deprecated since Chrome 70, please use privacy.services.autofillAddressEnabled and privacy.services.autofillCreditCardEnabled. This currently remains for backward compatibility and will be removed in the future.",
         "required": false,
-        "type": "integer",
-        "notes": "Deprecated since Chrome 70"
+        "type": "integer"
       },
       {
         "name": "save_passwords_enabled",
@@ -27510,7 +28760,7 @@
       },
       {
         "name": "privacy_sandbox_enabled",
-        "description": "1 if enabled else 0 - * Available for Chrome 90+; Deprecated since Chrome 111, see https://developer.chrome.com/docs/extensions/reference/privacy/#property-websites-privacySandboxEnabled",
+        "description": "1 if enabled else 0 - * Available for Chrome 90+ Deprecated since Chrome 111, see https://developer.chrome.com/docs/extensions/reference/privacy/#property-websites-privacySandboxEnabled",
         "required": false,
         "type": "integer"
       },
@@ -27542,190 +28792,15 @@
     "url": "https://fleetdm.com/tables/privacy_preferences",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml"
   },
-  {
-    "name": "puppet_logs",
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "description": "Outputs [Puppet](https://puppet.com/) logs from the last run.",
-    "platforms": ["darwin", "windows", "linux"],
-    "evented": false,
-    "examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```",
-    "columns": [
-      {
-        "name": "level",
-        "description": "The level of the log item (info, error, etc).",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "message",
-        "description": "The log message content.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "source",
-        "description": "The source of the log item.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "time",
-        "description": "The time at which this item was logged.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "file",
-        "description": "The file from which osquery read this log.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "line",
-        "description": "The line from which this log item was read.",
-        "required": false,
-        "type": "text"
-      }
-    ],
-    "url": "https://fleetdm.com/tables/puppet_logs",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml"
-  },
-  {
-    "name": "puppet_state",
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "description": "State of every resource [Puppet](https://puppet.com/) is managing. This table uses data from the `last_run_report` that Puppet creates.",
-    "platforms": ["darwin", "windows", "linux"],
-    "evented": false,
-    "examples": "List resources that failed or took over a minute to evaluate.\n```\nSELECT * FROM puppet_state WHERE failed='true' OR evaluation_time>'60';\n```",
-    "columns": [
-      {
-        "name": "title",
-        "description": "The name of the resource.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "file",
-        "description": "The file that contains the resource.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "line",
-        "description": "The line on which the resource is specified.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "resource",
-        "description": "The resource and its title as `Type[title]`.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "resource_type",
-        "description": "The resource type.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "evaluation_time",
-        "description": "The amount of seconds it took to evaluate the resource.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "failed",
-        "description": "If Puppet failed to evaluate this resource, this column is `true`.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "changed",
-        "description": "If `change_count` is above `0`, this is `true`.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "out_of_sync",
-        "description": "If `out_of_sync_count` is above `0`, this is `true`.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "skipped",
-        "description": "True if this resource was skipped.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "change_count",
-        "description": "The count of changes to be performed.",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "out_of_sync_count",
-        "description": "The number of properties that are out of sync",
-        "required": false,
-        "type": "text"
-      },
-      {
-        "name": "corrective_change",
-        "description": "True if a change on the system caused unexpected changes between two Puppet runs.",
-        "required": false,
-        "type": "text"
-      }
-    ],
-    "url": "https://fleetdm.com/tables/puppet_state",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml"
-  },
-  {
-    "name": "pwd_policy",
-    "platforms": ["darwin"],
-    "description": "Password Policiy (e.g max failed password attempts).",
-    "columns": [
-      {
-        "name": "max_failed_attempts",
-        "type": "integer",
-        "required": false,
-        "description": "The account lockout threshold specifies the amount of times a user can enter an incorrect password before a lockout will occur. Ensure that a lockout threshold is part of the password policy on the computer.\n"
-      },
-      {
-        "name": "expires_every_n_days",
-        "type": "integer",
-        "required": false,
-        "description": "How many days for a new password to expire.\n"
-      },
-      {
-        "name": "days_to_expiration",
-        "type": "integer",
-        "required": false,
-        "description": "How many days are left for the expiration of the current password.\n"
-      },
-      {
-        "name": "history_depth",
-        "type": "integer",
-        "required": false,
-        "description": "This parameter indicates the depth of password history which a new password can't be identical to.\n"
-      },
-      {
-        "name": "min_mixed_case_characters",
-        "type": "integer",
-        "required": false,
-        "description": "This parameter indicates the minimum number of mixed characters in a password.\n"
-      }
-    ],
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.\nFleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).\n",
-    "evented": false,
-    "url": "https://fleetdm.com/tables/pwd_policy",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml"
-  },
   {
     "name": "puppet_info",
     "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
     "description": "Information on the last [Puppet](https://puppet.com/) run. This table uses data from the `last_run_report` that Puppet creates.",
-    "platforms": ["darwin", "windows", "linux"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
     "evented": false,
     "examples": "List all the information available about the last Puppet run.\n```\nSELECT * FROM puppet_info;\n```",
     "columns": [
@@ -27835,9 +28910,221 @@
     "url": "https://fleetdm.com/tables/puppet_info",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml"
   },
+  {
+    "name": "puppet_state",
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "description": "State of every resource [Puppet](https://puppet.com/) is managing. This table uses data from the `last_run_report` that Puppet creates.",
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
+    "evented": false,
+    "examples": "List resources that failed or took over a minute to evaluate.\n```\nSELECT * FROM puppet_state WHERE failed='true' OR evaluation_time>'60';\n```",
+    "columns": [
+      {
+        "name": "title",
+        "description": "The name of the resource.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "file",
+        "description": "The file that contains the resource.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "line",
+        "description": "The line on which the resource is specified.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "resource",
+        "description": "The resource and its title as `Type[title]`.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "resource_type",
+        "description": "The resource type.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "evaluation_time",
+        "description": "The amount of seconds it took to evaluate the resource.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "failed",
+        "description": "If Puppet failed to evaluate this resource, this column is `true`.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "changed",
+        "description": "If `change_count` is above `0`, this is `true`.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "out_of_sync",
+        "description": "If `out_of_sync_count` is above `0`, this is `true`.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "skipped",
+        "description": "True if this resource was skipped.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "change_count",
+        "description": "The count of changes to be performed.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "out_of_sync_count",
+        "description": "The number of properties that are out of sync",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "corrective_change",
+        "description": "True if a change on the system caused unexpected changes between two Puppet runs.",
+        "required": false,
+        "type": "text"
+      }
+    ],
+    "url": "https://fleetdm.com/tables/puppet_state",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml"
+  },
+  {
+    "name": "puppet_logs",
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "description": "Outputs [Puppet](https://puppet.com/) logs from the last run.",
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
+    "evented": false,
+    "examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```",
+    "columns": [
+      {
+        "name": "level",
+        "description": "The level of the log item (info, error, etc).",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "message",
+        "description": "The log message content.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "source",
+        "description": "The source of the log item.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "time",
+        "description": "The time at which this item was logged.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "file",
+        "description": "The file from which osquery read this log.",
+        "required": false,
+        "type": "text"
+      },
+      {
+        "name": "line",
+        "description": "The line from which this log item was read.",
+        "required": false,
+        "type": "text"
+      }
+    ],
+    "url": "https://fleetdm.com/tables/puppet_logs",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml"
+  },
+  {
+    "name": "pwd_policy",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Password Policiy (e.g max failed password attempts).",
+    "columns": [
+      {
+        "name": "max_failed_attempts",
+        "type": "integer",
+        "required": false,
+        "description": "The account lockout threshold specifies the amount of times a user can enter an incorrect password before a lockout will occur. Ensure that a lockout threshold is part of the password policy on the computer.\n"
+      },
+      {
+        "name": "expires_every_n_days",
+        "type": "integer",
+        "required": false,
+        "description": "How many days for a new password to expire.\n"
+      },
+      {
+        "name": "days_to_expiration",
+        "type": "integer",
+        "required": false,
+        "description": "How many days are left for the expiration of the current password.\n"
+      },
+      {
+        "name": "history_depth",
+        "type": "integer",
+        "required": false,
+        "description": "This parameter indicates the depth of password history which a new password can't be identical to.\n"
+      },
+      {
+        "name": "min_mixed_case_characters",
+        "type": "integer",
+        "required": false,
+        "description": "This parameter indicates the minimum number of mixed characters in a password.\n"
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.\nFleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).\n",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/pwd_policy",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml"
+  },
+  {
+    "name": "software_update",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Information about available Apple software updates.",
+    "columns": [
+      {
+        "name": "software_update_required",
+        "type": "integer",
+        "required": false,
+        "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/software_update",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
+  },
   {
     "name": "sntp_request",
-    "platforms": ["darwin", "windows", "linux"],
+    "platforms": [
+      "darwin",
+      "windows",
+      "linux"
+    ],
     "description": "Allows querying the timestamp and clock offset from a SNTP server (in millisecond precision).",
     "columns": [
       {
@@ -27866,7 +29153,9 @@
   },
   {
     "name": "sudo_info",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Returns the output of `sudo -V` in JSON format.",
     "columns": [
       {
@@ -27883,7 +29172,9 @@
   },
   {
     "name": "system_state",
-    "platforms": ["chrome"],
+    "platforms": [
+      "chrome"
+    ],
     "description": "Returns \"locked\" if the system is locked, \"idle\" if the user has not generated any input for a specified number of seconds, or \"active\" otherwise. Idle time is set to 20% of the user's autolock time or defaults to 30 seconds if autolock is not set.",
     "examples": "Returns \"locked\", \"idle\", or \"active\".\n```\nSELECT idle_state FROM system_state;\n```",
     "columns": [
@@ -27899,26 +29190,11 @@
     "url": "https://fleetdm.com/tables/system_state",
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml"
   },
-  {
-    "name": "software_update",
-    "platforms": ["darwin"],
-    "description": "Information about available Apple software updates.",
-    "columns": [
-      {
-        "name": "software_update_required",
-        "type": "integer",
-        "required": false,
-        "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
-      }
-    ],
-    "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
-    "evented": false,
-    "url": "https://fleetdm.com/tables/software_update",
-    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
-  },
   {
     "name": "user_login_settings",
-    "platforms": ["darwin"],
+    "platforms": [
+      "darwin"
+    ],
     "description": "Options of login and password (e.g password hints enabled) for all users.",
     "columns": [
       {
diff --git a/schema/tables/find_cmd.yml b/schema/tables/find_cmd.yml
new file mode 100644
index 0000000000..18df5bc422
--- /dev/null
+++ b/schema/tables/find_cmd.yml
@@ -0,0 +1,29 @@
+name: find_cmd
+platforms:
+  - darwin
+description: Uses the /usr/bin/find command to list files and directories.
+columns:
+  - name: directory
+    type: text
+    required: true
+    description: |
+      The directory passed to find as first argument.
+  - name: type
+    type: text
+    required: false
+    description: |
+      Sets the value of the `-type` flag.
+  - name: perm
+    type: text
+    required: false
+    description: |
+      Sets the value of the `-perm` flag.
+  - name: path
+    type: text
+    required: false
+    description: |
+      Contains the found paths.
+notes: |
+  This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.
+  Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
+evented: false
diff --git a/tools/loadtest/osquery/macos/gnuplot_osqueryd_cpu_memory.sh b/tools/loadtest/osquery/macos/gnuplot_osqueryd_cpu_memory.sh
index e69322c064..d44902771e 100755
--- a/tools/loadtest/osquery/macos/gnuplot_osqueryd_cpu_memory.sh
+++ b/tools/loadtest/osquery/macos/gnuplot_osqueryd_cpu_memory.sh
@@ -23,7 +23,7 @@ set terminal jpeg
 
 set title 'Memory (MB)'
 set output 'osquery_worker_memory.jpg'
-plot '/tmp/osqueryd.dat' using 1:3 with linespoints linetype 7 linewidth 2 title 'Memory (MB)'
+plot '/tmp/osqueryd.dat' using 1:3 with linespoints linetype -1 linewidth 1 title 'Memory (MB)'
 
 set title 'CPU'
 set output 'osquery_worker_cpu.jpg'
@@ -34,10 +34,10 @@ set yrange [0:24000]
 # where default values are: check_interval=3000ms, percent_cpu_limit=10%.
 # On my Macbook with 4 physical core this gives 1200ms.
 #
-plot '/tmp/osqueryd.dat' using 1:2 with linespoints linetype 6 linewidth 2 title 'CPU', 1200 linecolor 1
+plot '/tmp/osqueryd.dat' using 1:2 with linespoints linetype -1 linewidth 1 title 'CPU', 1200 linecolor 1
 EOF
 
 gnuplot < gnuplot_commands.txt
 rm gnuplot_commands.txt
 
-open osquery_worker_cpu.jpg osquery_worker_memory.jpg
\ No newline at end of file
+open osquery_worker_cpu.jpg osquery_worker_memory.jpg