Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

Refine system_profiler table examples and description (#34053)

Browse Source 
Updated examples in system_profiler table to reflect correct JSON
extraction paths and added new example for collecting audio devices.
Enhanced the table description for clarity.
This commit is contained in:
Zach Wasserman
2025-10-10 15:56:49 -04:00
committed by GitHub
parent 3be8a90575
commit bfd0758922
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/osquery_fleet_schema.json
+3 -3
View File
@@ -27149,15 +27149,15 @@
},
{
"name": "system_profiler",
"description": "The system_profiler osquery table collects data from the macOS system_profiler binary. ",
"description": "The system_profiler osquery table collects data from the macOS system profiler utility and returns it in JSON format.",
"url": "https://fleetdm.com/tables/system_profiler",
"platforms": [
"darwin"
],
"evented": false,
"cacheable": false,
"notes": "The macOS system_profiler binary reports on the hardware and software configuration of a Mac. It generates detailed, plain text, XML or json reports which can be exported from the Terminal or generated as .spx files and read by the macOS System Information.app based on \"data types\". \n\nThe system_profiler output is a rich source of data containing unique, per device hardware and software attributes which have many uses for enhancing Mac management.\n\nNot all System Profiler data types are available via the system_profiler osquery table. Some data types are legacy & others are OS version-specific. \n\nThe following data types are available from the system_profiler binary as of macOS 26:\n\n- SPParallelATADataType\n- SPUniversalAccessDataType\n- SPSecureElementDataType\n- SPApplicationsDataType\n- SPAudioDataType\n- SPBluetoothDataType\n- SPCameraDataType\n- SPCardReaderDataType\n- SPiBridgeDataType\n- SPDeveloperToolsDataType\n- SPDiagnosticsDataType\n- SPDisabledSoftwareDataType\n- SPDiscBurningDataType\n- SPEthernetDataType\n- SPExtensionsDataType\n- SPFibreChannelDataType\n- SPFirewallDataType\n- SPFontsDataType\n- SPFrameworksDataType\n- SPDisplaysDataType\n- SPHardwareDataType\n- SPInstallHistoryDataType\n- SPInternationalDataType\n- SPNetworkLocationDataType\n- SPLogsDataType\n- SPManagedClientDataType\n- SPMemoryDataType\n- SPNVMeDataType\n- SPNetworkDataType\n- SPPCIDataType\n- SPParallelSCSIDataType\n- SPPowerDataType\n- SPPrefPaneDataType\n- SPPrintersSoftwareDataType\n- SPPrintersDataType\n- SPConfigurationProfileDataType\n- SPRawCameraDataType\n- SPLegacySoftwareDataType\n- SPSASDataType\n- SPSerialATADataType\n- SPSPIDataType\n- SPSmartCardsDataType\n- SPSoftwareDataType\n- SPStartupItemDataType\n- SPStorageDataType\n- SPSyncServicesDataType\n- SPThunderboltDataType\n- SPUSBHostDataType\n- SPNetworkVolumeDataType\n- SPAirPortDataType",
"examples": "\nCollect Mac Activation Lock Status:\n\n```\nSELECT json_extract (value,'$.activation_lock_status')\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```\n\nCollect Mac Hardware UUID (platform_uuid):\n\n```\nSELECT json_extract (value,'$.platform_UUID')\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```\n\nCollect Mac Serial Number:\n\n```\nSELECT json_extract (value,'$.serial_number')\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```",
"notes": "The macOS system_profiler binary reports on the hardware and software configuration of a Mac. It generates detailed, plain text, XML or json reports which can be exported from the Terminal or generated as .spx files and read by the macOS System Information.app based on \"data types\". \n\nThe system_profiler output is a rich source of data containing unique, per device hardware and software attributes which have many uses for enhancing Mac management.\n\nThe following data types are available from the system_profiler binary as of macOS 26:\n\n- SPParallelATADataType\n- SPUniversalAccessDataType\n- SPSecureElementDataType\n- SPApplicationsDataType\n- SPAudioDataType\n- SPBluetoothDataType\n- SPCameraDataType\n- SPCardReaderDataType\n- SPiBridgeDataType\n- SPDeveloperToolsDataType\n- SPDiagnosticsDataType\n- SPDisabledSoftwareDataType\n- SPDiscBurningDataType\n- SPEthernetDataType\n- SPExtensionsDataType\n- SPFibreChannelDataType\n- SPFirewallDataType\n- SPFontsDataType\n- SPFrameworksDataType\n- SPDisplaysDataType\n- SPHardwareDataType\n- SPInstallHistoryDataType\n- SPInternationalDataType\n- SPNetworkLocationDataType\n- SPLogsDataType\n- SPManagedClientDataType\n- SPMemoryDataType\n- SPNVMeDataType\n- SPNetworkDataType\n- SPPCIDataType\n- SPParallelSCSIDataType\n- SPPowerDataType\n- SPPrefPaneDataType\n- SPPrintersSoftwareDataType\n- SPPrintersDataType\n- SPConfigurationProfileDataType\n- SPRawCameraDataType\n- SPLegacySoftwareDataType\n- SPSASDataType\n- SPSerialATADataType\n- SPSPIDataType\n- SPSmartCardsDataType\n- SPSoftwareDataType\n- SPStartupItemDataType\n- SPStorageDataType\n- SPSyncServicesDataType\n- SPThunderboltDataType\n- SPUSBHostDataType\n- SPNetworkVolumeDataType\n- SPAirPortDataType\n\nBecause this table returns JSON values, the [SQLite JSON functions](https://sqlite.org/json1.html) are useful for parsing and transforming results.",
"examples": "\nCollect Mac Activation Lock Status:\n\n```\nSELECT json_extract (value,'$[0].activation_lock_status') AS activation_lock_status\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```\n\nCollect Mac Hardware UUID (platform_uuid):\n\n```\nSELECT json_extract (value,'$[0].platform_UUID') AS hardware_uuid\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```\n\nCollect Mac Serial Number:\n\n```\nSELECT json_extract (value,'$[0].serial_number') AS serial_number\nFROM system_profiler\nWHERE data_type='SPHardwareDataType';\n```\n\nCollect Audio Devices:\n\n```\nSELECT each.value->>'_name' AS name, each.value->>'coreaudio_device_manufacturer' AS manufacturer\nFROM system_profiler sp, JSON_EACH(sp.value->'[0]._items') each\nWHERE data_type = 'SPAudioDataType';\n```",
"columns": [
{
"name": "data_type",
schema/tables/system_profiler.yml
+14 -6
View File
@@ -1,12 +1,12 @@
name: system_profiler
description: |-
The system_profiler osquery table collects data from the macOS system_profiler binary.
The system_profiler osquery table collects data from the macOS system profiler utility and returns it in JSON format.
examples: |-
Collect Mac Activation Lock Status:
```
SELECT json_extract (value,'$.activation_lock_status')
SELECT json_extract (value,'$[0].activation_lock_status') AS activation_lock_status
FROM system_profiler
WHERE data_type='SPHardwareDataType';
```
@@ -14,7 +14,7 @@ examples: |-
Collect Mac Hardware UUID (platform_uuid):
```
SELECT json_extract (value,'$.platform_UUID')
SELECT json_extract (value,'$[0].platform_UUID') AS hardware_uuid
FROM system_profiler
WHERE data_type='SPHardwareDataType';
```
@@ -22,17 +22,23 @@ examples: |-
Collect Mac Serial Number:
```
SELECT json_extract (value,'$.serial_number')
SELECT json_extract (value,'$[0].serial_number') AS serial_number
FROM system_profiler
WHERE data_type='SPHardwareDataType';
```
Collect Audio Devices:
```
SELECT each.value->>'_name' AS name, each.value->>'coreaudio_device_manufacturer' AS manufacturer
FROM system_profiler sp, JSON_EACH(sp.value->'[0]._items') each
WHERE data_type = 'SPAudioDataType';
```
notes: |-
The macOS system_profiler binary reports on the hardware and software configuration of a Mac. It generates detailed, plain text, XML or json reports which can be exported from the Terminal or generated as .spx files and read by the macOS System Information.app based on "data types".
The system_profiler output is a rich source of data containing unique, per device hardware and software attributes which have many uses for enhancing Mac management.
Not all System Profiler data types are available via the system_profiler osquery table. Some data types are legacy & others are OS version-specific.
The following data types are available from the system_profiler binary as of macOS 26:
@@ -86,3 +92,5 @@ notes: |-
- SPUSBHostDataType
- SPNetworkVolumeDataType
- SPAirPortDataType
Because this table returns JSON values, the [SQLite JSON functions](https://sqlite.org/json1.html) are useful for parsing and transforming results.