From f0bfff2b6c87dbc97503a629fd97a40c96ceafda Mon Sep 17 00:00:00 2001 From: Brock Walters <153771548+nonpunctual@users.noreply.github.com> Date: Wed, 4 Feb 2026 18:40:34 -0500 Subject: [PATCH] Add SQL query for last connected times in wifi_networks (#37919) Added example SQL query to discover last connected times for WiFi networks highlighting new columns. --------- Co-authored-by: Eric --- schema/osquery_fleet_schema.json | 2 +- schema/tables/wifi_networks.yml | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 329242f614..4538f91166 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -29781,7 +29781,7 @@ "evented": false, "cacheable": true, "notes": "", - "examples": "Find WiFi networks configured on Macs that are unencrypted and require a\ncaptive portal. This can be useful to understand how much people use laptops\nin hotels, airports and other environments, and is a good indicator that tools\nsuch as DNS-over-HTTPS would improve privacy of connectivity.\n\n```\nSELECT network_name FROM wifi_networks WHERE security_type='Open' AND captive_portal='1';\n```", + "examples": "Find WiFi networks configured on Macs that are unencrypted and require a\ncaptive portal. This can be useful to understand how much people use laptops\nin hotels, airports and other environments, and is a good indicator that tools\nsuch as DNS-over-HTTPS would improve privacy of connectivity.\n\n```\nSELECT network_name FROM wifi_networks WHERE security_type='Open' AND captive_portal='1';\n```\n\nDiscover last connected times for WiFi networks:\n\n```\nSELECT network_name,last_connected,last_connected_automatic,last_connected_manual\nFROM wifi_networks\nORDER BY \nCOALESCE(last_connected, 0) \nDESC\nLIMIT 10;\n```", "columns": [ { "name": "ssid", diff --git a/schema/tables/wifi_networks.yml b/schema/tables/wifi_networks.yml index 3605e002d0..9485b8d706 100644 --- a/schema/tables/wifi_networks.yml +++ b/schema/tables/wifi_networks.yml @@ -9,3 +9,14 @@ examples: |- ``` SELECT network_name FROM wifi_networks WHERE security_type='Open' AND captive_portal='1'; ``` + + Discover last connected times for WiFi networks: + + ``` + SELECT network_name,last_connected,last_connected_automatic,last_connected_manual + FROM wifi_networks + ORDER BY + COALESCE(last_connected, 0) + DESC + LIMIT 10; + ```