Module Expr Str ImportFrom alias Import alias Import alias Import alias Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Dict Str Str Str Str Str Str Assign NameStore Str FunctionDef arguments args defaults body If Call AttributeLoad AttributeLoad NameLoad attr attr Str body Return NameLoad Return TupleLoad NameLoad Str decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call AttributeLoad Str attr NameLoad Assign NameStore Call SubscriptLoad NameLoad Index Str NameLoad If CompareEq SubscriptLoad NameLoad Index Str Num body Assign NameStore ListLoad Assign NameStore Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str Return NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults Str body Expr Str Assign NameStore Dict Str NameLoad Assign NameStore Call AttributeLoad Str attr NameLoad Assign NameStore Call SubscriptLoad NameLoad Index Str NameLoad If CompareEq SubscriptLoad NameLoad Index Str Num body Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Index Str orelse Assign SubscriptStore NameLoad Index Str NameLoad Assign SubscriptStore NameLoad Index Str SubscriptLoad NameLoad Index Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults NameLoad NameLoad Str body Expr Str Assign NameStore Dict Str NameLoad If NameLoad body If Call NameLoad NameLoad NameLoad body Assign NameStore Call NameLoad NameLoad If NameLoad body For NameStore NameLoad body If CompareNotIn NameLoad NameLoad body Assign SubscriptStore NameLoad Index Str NameLoad Assign SubscriptStore NameLoad Index Str Call AttributeLoad Str attr NameLoad NameLoad Return NameLoad Assign NameStore Call AttributeLoad Str attr NameLoad orelse Assign SubscriptStore NameLoad Index Str NameLoad Assign SubscriptStore NameLoad Index Str Call AttributeLoad Str attr NameLoad Return NameLoad orelse Assign SubscriptStore NameLoad Index Str Str Assign SubscriptStore NameLoad Index Str NameLoad Return NameLoad orelse Assign NameStore Str Assign NameStore Call AttributeLoad Str attr NameLoad NameLoad If NameLoad body Assign NameStore Call AttributeLoad Str attr NameLoad NameLoad Assign NameStore Call AttributeLoad Str attr NameLoad Assign NameStore Call NameLoad NameLoad If SubscriptLoad NameLoad Index Str body Assign SubscriptStore NameLoad Index Str SubscriptLoad NameLoad Index Str orelse Assign SubscriptStore NameLoad Index Str SubscriptLoad NameLoad Index Str Return NameLoad decorator_list FunctionDef arguments args defaults body Expr Str Assign NameStore Call NameLoad keyword Str keyword ListLoad Str If BoolOpAnd NameLoad Call NameLoad NameLoad NameLoad body Return BoolOpOr Call AttributeLoad SubscriptLoad NameLoad Index Num attr Str Str NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareEq SubscriptLoad NameLoad Index Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareIn SubscriptLoad NameLoad Index Str ListLoad Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareIn SubscriptLoad NameLoad Index Str ListLoad Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareIn SubscriptLoad NameLoad Index Str ListLoad Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareIn SubscriptLoad NameLoad Index Str ListLoad Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareIn SubscriptLoad NameLoad Index Str ListLoad Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareEq SubscriptLoad NameLoad Index Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If CompareEq SubscriptLoad NameLoad Index Str Str body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str If Call AttributeLoad AttributeLoad NameLoad attr attr body Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad Return Dict Str Str NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args NameParam defaults NameLoad body Expr Str Return Call NameLoad keyword Str keyword NameLoad decorator_list FunctionDef arguments args NameParam defaults NameLoad body Expr Str Return Call NameLoad NameLoad decorator_list
N/A N/A 
Support for OSQuery - https://osquery.io.

.. versionadded:: 2015.8.0
 __future__ absolute_import N/A json N/A salt.utils N/A logging N/A log N/A N/A logging getLogger __name__ N/A __func_alias__ N/A file_ hash_ time_ file hash time N/A __virtualname__ osquery __virtual__ N/A N/A N/A N/A N/A N/A N/A N/A salt utils which osqueryi N/A N/A __virtualname__ N/A N/A False The osquery execution module cannot be loaded: osqueryi binary is not in the path. N/A _table_attrs N/A N/A table N/A N/A N/A 
    Helper function to find valid table attributes
     N/A cmd N/A N/A osqueryi --json "pragma table_info({0})" format table N/A res N/A N/A __salt__ N/A cmd.run_all cmd N/A N/A N/A res N/A retcode 0 N/A N/A attrs N/A N/A text N/A N/A json loads N/A res N/A stdout N/A item text N/A N/A N/A N/A attrs append N/A item N/A name N/A attrs N/A False N/A _osquery N/A N/A sql format N/A json N/A N/A 
    Helper function to run raw osquery queries
     N/A ret N/A result True N/A cmd N/A N/A osqueryi --json "{0}" format sql N/A res N/A N/A __salt__ N/A cmd.run_all cmd N/A N/A N/A res N/A retcode 0 N/A N/A N/A ret N/A data N/A N/A json loads N/A res N/A stdout N/A N/A N/A ret N/A result False N/A N/A ret N/A error N/A res N/A stderr N/A ret N/A _osquery_cmd N/A N/A table attrs where format N/A None None json N/A N/A 
    Helper function to run osquery queries
     N/A ret N/A result True N/A attrs N/A N/A N/A isinstance attrs list N/A N/A valid_attrs N/A _table_attrs table N/A valid_attrs N/A N/A a attrs N/A N/A N/A a valid_attrs N/A N/A N/A ret N/A result False N/A N/A ret N/A comment N/A N/A {0} is not a valid attribute for table {1} format a table N/A ret N/A _attrs N/A N/A , join attrs N/A N/A N/A ret N/A result False N/A N/A ret N/A comment N/A N/A Invalid table {0}. format table N/A ret N/A N/A N/A ret N/A comment attrs must be specified as a list. N/A N/A ret N/A result False N/A ret N/A N/A _attrs * N/A sql N/A N/A select {0} from {1} format _attrs table N/A where N/A N/A sql N/A N/A {0} where {1} format sql where N/A sql N/A N/A {0}; format sql N/A res N/A _osquery sql N/A N/A res N/A result N/A N/A N/A ret N/A data N/A res N/A data N/A N/A N/A ret N/A comment N/A res N/A error N/A ret N/A version N/A N/A N/A N/A N/A 
    Return version of osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.version
     N/A res N/A _osquery_cmd table osquery_info attrs N/A version N/A N/A res N/A isinstance res list N/A N/A N/A N/A N/A N/A res N/A 0 get version False N/A rpm_packages N/A N/A attrs where N/A None None N/A N/A 
    Return cpuid information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.rpm_packages
     N/A N/A N/A __grains__ N/A os_family RedHat N/A N/A N/A _osquery_cmd table rpm_packages attrs attrs where where N/A N/A result comment False Only available on Red Hat based systems. N/A kernel_integrity N/A N/A attrs where N/A None None N/A N/A 
    Return kernel_integrity information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_integrity
     N/A N/A N/A __grains__ N/A os_family N/A RedHat Debian N/A N/A N/A _osquery_cmd table kernel_integrity attrs attrs where where N/A N/A result comment False Only available on Red Hat or Debian based systems. N/A kernel_modules N/A N/A attrs where N/A None None N/A N/A 
    Return kernel_modules information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_modules
     N/A N/A N/A __grains__ N/A os_family N/A RedHat Debian N/A N/A N/A _osquery_cmd table kernel_modules attrs attrs where where N/A N/A result comment False Only available on Red Hat or Debian based systems. N/A memory_map N/A N/A attrs where N/A None None N/A N/A 
    Return memory_map information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.memory_map
     N/A N/A N/A __grains__ N/A os_family N/A RedHat Debian N/A N/A N/A _osquery_cmd table memory_map attrs attrs where where N/A N/A result comment False Only available on Red Hat or Debian based systems. N/A process_memory_map N/A N/A attrs where N/A None None N/A N/A 
    Return process_memory_map information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_memory_map
     N/A N/A N/A __grains__ N/A os_family N/A RedHat Debian N/A N/A N/A _osquery_cmd table process_memory_map attrs attrs where where N/A N/A result comment False Only available on Red Hat or Debian based systems. N/A shared_memory N/A N/A attrs where N/A None None N/A N/A 
    Return shared_memory information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.shared_memory
     N/A N/A N/A __grains__ N/A os_family N/A RedHat Debian N/A N/A N/A _osquery_cmd table shared_memory attrs attrs where where N/A N/A result comment False Only available on Red Hat or Debian based systems. N/A apt_sources N/A N/A attrs where N/A None None N/A N/A 
    Return apt_sources information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.apt_sources
     N/A N/A N/A __grains__ N/A os_family Debian N/A N/A N/A _osquery_cmd table apt_sources attrs attrs where where N/A N/A result comment False Only available on Debian based systems. N/A deb_packages N/A N/A attrs where N/A None None N/A N/A 
    Return deb_packages information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.deb_packages
     N/A N/A N/A __grains__ N/A os_family Debian N/A N/A N/A _osquery_cmd table deb_packages attrs attrs where where N/A N/A result comment False Only available on Debian based systems. N/A acpi_tables N/A N/A attrs where N/A None None N/A N/A 
    Return acpi_tables information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.acpi_tables
     N/A N/A _osquery_cmd table acpi_tables attrs attrs where where N/A arp_cache N/A N/A attrs where N/A None None N/A N/A 
    Return arp_cache information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.arp_cache
     N/A N/A _osquery_cmd table arp_cache attrs attrs where where N/A block_devices N/A N/A attrs where N/A None None N/A N/A 
    Return block_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.block_devices
     N/A N/A _osquery_cmd table block_devices attrs attrs where where N/A cpuid N/A N/A attrs where N/A None None N/A N/A 
    Return cpuid information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.cpuid
     N/A N/A _osquery_cmd table cpuid attrs attrs where where N/A crontab N/A N/A attrs where N/A None None N/A N/A 
    Return crontab information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.crontab
     N/A N/A _osquery_cmd table crontab attrs attrs where where N/A etc_hosts N/A N/A attrs where N/A None None N/A N/A 
    Return etc_hosts information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.etc_hosts
     N/A N/A _osquery_cmd table etc_hosts attrs attrs where where N/A etc_services N/A N/A attrs where N/A None None N/A N/A 
    Return etc_services information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.etc_services
     N/A N/A _osquery_cmd table etc_services attrs attrs where where N/A file_changes N/A N/A attrs where N/A None None N/A N/A 
    Return file_changes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.file_changes
     N/A N/A _osquery_cmd table file_changes attrs attrs where where N/A groups N/A N/A attrs where N/A None None N/A N/A 
    Return groups information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.groups
     N/A N/A _osquery_cmd table groups attrs attrs where where N/A hardware_events N/A N/A attrs where N/A None None N/A N/A 
    Return hardware_events information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.hardware_events
     N/A N/A _osquery_cmd table hardware_events attrs attrs where where N/A interface_addresses N/A N/A attrs where N/A None None N/A N/A 
    Return interface_addresses information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.interface_addresses
     N/A N/A _osquery_cmd table interface_addresses attrs attrs where where N/A interface_details N/A N/A attrs where N/A None None N/A N/A 
    Return interface_details information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.interface_details
     N/A N/A _osquery_cmd table interface_details attrs attrs where where N/A kernel_info N/A N/A attrs where N/A None None N/A N/A 
    Return kernel_info information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_info
     N/A N/A _osquery_cmd table kernel_info attrs attrs where where N/A last N/A N/A attrs where N/A None None N/A N/A 
    Return last information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.last
     N/A N/A _osquery_cmd table last attrs attrs where where N/A listening_ports N/A N/A attrs where N/A None None N/A N/A 
    Return listening_ports information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.listening_ports
     N/A N/A _osquery_cmd table listening_ports attrs attrs where where N/A logged_in_users N/A N/A attrs where N/A None None N/A N/A 
    Return logged_in_users information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.logged_in_users
     N/A N/A _osquery_cmd table logged_in_users attrs attrs where where N/A mounts N/A N/A attrs where N/A None None N/A N/A 
    Return mounts information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.mounts
     N/A N/A _osquery_cmd table mounts attrs attrs where where N/A os_version N/A N/A attrs where N/A None None N/A N/A 
    Return os_version information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.os_version
     N/A N/A _osquery_cmd table os_version attrs attrs where where N/A passwd_changes N/A N/A attrs where N/A None None N/A N/A 
    Return passwd_changes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.passwd_changes
     N/A N/A _osquery_cmd table passwd_changes attrs attrs where where N/A pci_devices N/A N/A attrs where N/A None None N/A N/A 
    Return pci_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.pci_devices
     N/A N/A _osquery_cmd table pci_devices attrs attrs where where N/A process_envs N/A N/A attrs where N/A None None N/A N/A 
    Return process_envs information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_envs
     N/A N/A _osquery_cmd table process_envs attrs attrs where where N/A process_open_files N/A N/A attrs where N/A None None N/A N/A 
    Return process_open_files information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_open_files
     N/A N/A _osquery_cmd table process_open_files attrs attrs where where N/A process_open_sockets N/A N/A attrs where N/A None None N/A N/A 
    Return process_open_sockets information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_open_sockets
     N/A N/A _osquery_cmd table process_open_sockets attrs attrs where where N/A processes N/A N/A attrs where N/A None None N/A N/A 
    Return processes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.processes
     N/A N/A _osquery_cmd table processes attrs attrs where where N/A routes N/A N/A attrs where N/A None None N/A N/A 
    Return routes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.routes
     N/A N/A _osquery_cmd table routes attrs attrs where where N/A shell_history N/A N/A attrs where N/A None None N/A N/A 
    Return shell_history information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.shell_history
     N/A N/A _osquery_cmd table shell_history attrs attrs where where N/A smbios_tables N/A N/A attrs where N/A None None N/A N/A 
    Return smbios_tables information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.smbios_tables
     N/A N/A _osquery_cmd table smbios_tables attrs attrs where where N/A suid_bin N/A N/A attrs where N/A None None N/A N/A 
    Return suid_bin information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.suid_bin
     N/A N/A _osquery_cmd table suid_bin attrs attrs where where N/A system_controls N/A N/A attrs where N/A None None N/A N/A 
    Return system_controls information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.system_controls
     N/A N/A _osquery_cmd table system_controls attrs attrs where where N/A usb_devices N/A N/A attrs where N/A None None N/A N/A 
    Return usb_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.usb_devices
     N/A N/A _osquery_cmd table usb_devices attrs attrs where where N/A users N/A N/A attrs where N/A None None N/A N/A 
    Return users information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.users
     N/A N/A _osquery_cmd table users attrs attrs where where N/A alf N/A N/A attrs where N/A None None N/A N/A 
    Return alf information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table alf attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A alf_exceptions N/A N/A attrs where N/A None None N/A N/A 
    Return alf_exceptions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_exceptions
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table alf_exceptions attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A alf_explicit_auths N/A N/A attrs where N/A None None N/A N/A 
    Return alf_explicit_auths information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_explicit_auths
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table alf_explicit_auths attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A alf_services N/A N/A attrs where N/A None None N/A N/A 
    Return alf_services information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_services
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table alf_services attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A apps N/A N/A attrs where N/A None None N/A N/A 
    Return apps information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.apps
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table apps attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A certificates N/A N/A attrs where N/A None None N/A N/A 
    Return certificates information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.certificates
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table certificates attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A chrome_extensions N/A N/A attrs where N/A None None N/A N/A 
    Return chrome_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.chrome_extensions
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table chrome_extensions attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A firefox_addons N/A N/A attrs where N/A None None N/A N/A 
    Return firefox_addons information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.firefox_addons
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table firefox_addons attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A homebrew_packages N/A N/A attrs where N/A None None N/A N/A 
    Return homebrew_packages information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.homebrew_packages
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table homebrew_packages attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A iokit_devicetree N/A N/A attrs where N/A None None N/A N/A 
    Return iokit_devicetree information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.iokit_devicetree
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table iokit_devicetree attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A iokit_registry N/A N/A attrs where N/A None None N/A N/A 
    Return iokit_registry information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.iokit_registry
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table iokit_registry attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A kernel_extensions N/A N/A attrs where N/A None None N/A N/A 
    Return kernel_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_extensions
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table kernel_extensions attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A keychain_items N/A N/A attrs where N/A None None N/A N/A 
    Return keychain_items information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.keychain_items
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table keychain_items attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A launchd N/A N/A attrs where N/A None None N/A N/A 
    Return launchd information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.launchd
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table launchd attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A nfs_shares N/A N/A attrs where N/A None None N/A N/A 
    Return nfs_shares information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.nfs_shares
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table nfs_shares attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A nvram N/A N/A attrs where N/A None None N/A N/A 
    Return nvram information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.nvram
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table nvram attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A preferences N/A N/A attrs where N/A None None N/A N/A 
    Return preferences information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.preferences
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table preferences attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A quarantine N/A N/A attrs where N/A None None N/A N/A 
    Return quarantine information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.quarantine
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table quarantine attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A safari_extensions N/A N/A attrs where N/A None None N/A N/A 
    Return safari_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.safari_extensions
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table safari_extensions attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A startup_items N/A N/A attrs where N/A None None N/A N/A 
    Return startup_items information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.startup_items
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table startup_items attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A xattr_where_from N/A N/A attrs where N/A None None N/A N/A 
    Return xattr_where_from information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xattr_where_from
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table xattr_where_from attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A xprotect_entries N/A N/A attrs where N/A None None N/A N/A 
    Return xprotect_entries information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xprotect_entries
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table xprotect_entries attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A xprotect_reports N/A N/A attrs where N/A None None N/A N/A 
    Return xprotect_reports information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xprotect_reports
     N/A N/A N/A N/A salt utils is_darwin N/A N/A N/A _osquery_cmd table xprotect_reports attrs attrs where where N/A N/A result comment False Only available on OS X systems. N/A file_ N/A N/A attrs where N/A None None N/A N/A 
    Return file information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.file
     N/A N/A _osquery_cmd table file attrs attrs where where N/A hash_ N/A N/A attrs where N/A None None N/A N/A 
    Return hash information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.hash
     N/A N/A _osquery_cmd table hash attrs attrs where where N/A osquery_extensions N/A N/A attrs where N/A None None N/A N/A 
    Return osquery_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_extensions
     N/A N/A _osquery_cmd table osquery_extensions attrs attrs where where N/A osquery_flags N/A N/A attrs where N/A None None N/A N/A 
    Return osquery_flags information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_flags
     N/A N/A _osquery_cmd table osquery_flags attrs attrs where where N/A osquery_info N/A N/A attrs where N/A None None N/A N/A 
    Return osquery_info information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_info
     N/A N/A _osquery_cmd table osquery_info attrs attrs where where N/A osquery_registry N/A N/A attrs where N/A None None N/A N/A 
    Return osquery_registry information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_registry
     N/A N/A _osquery_cmd table osquery_registry attrs attrs where where N/A time_ N/A N/A attrs N/A None N/A N/A 
    Return time information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.time
     N/A N/A _osquery_cmd table time attrs attrs N/A query N/A N/A sql N/A None N/A N/A 
    Return time information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.query "select * from users;"
     N/A N/A _osquery sql N/A