Back to Beats

elastic_file_analysis

x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_file_analysis.md

9.4.02.3 KB
Original Source

% This file is generated! See ext/osquery-extension/cmd/gentables.

elastic_file_analysis

Comprehensive security analysis of executable files on macOS (file type, code signing, dependencies, symbols, strings)

Platforms

  • ❌ Linux
  • ✅ macOS
  • ❌ Windows

Description

Perform comprehensive security analysis of executable files on macOS. This table combines multiple macOS system tools to extract metadata, code signing information, library dependencies, symbols, and embedded strings from binary files. Query with a path constraint (e.g. WHERE path = '/usr/bin/ssh'). Useful for malware analysis, code signing verification, security auditing, binary forensics, and supply chain assessment.

Schema

ColumnTypeDescription
pathTEXTAbsolute path to the file being analyzed
modeTEXTFile permissions (e.g., 755)
uidBIGINTFile owner user ID
gidBIGINTFile owner group ID
sizeBIGINTFile size in bytes
mtimeBIGINTLast modification time (Unix timestamp)
file_typeTEXTFile type and architecture from the file command
code_signTEXTCode signing information from codesign -dvvv
dependenciesTEXTLinked libraries from otool -L
symbolsTEXTExported symbols from nm
stringsTEXTPrintable strings from binary (>= 4 characters)

Examples

Analyze a specific executable

sql
SELECT * FROM elastic_file_analysis
WHERE path = '/Applications/Safari.app/Contents/MacOS/Safari';

Analyze executables in a directory

sql
SELECT path, file_type, size
FROM elastic_file_analysis
WHERE path LIKE '/usr/local/bin/%';

Get metadata and code signing

sql
SELECT path, file_type, code_sign FROM elastic_file_analysis WHERE path = '/usr/bin/sudo';

List library dependencies

sql
SELECT path, dependencies FROM elastic_file_analysis WHERE path = '/usr/bin/ssh';

Extract strings from binary

sql
SELECT path, strings FROM elastic_file_analysis WHERE path = '/usr/bin/curl';

Notes

  • macOS only. Requires path constraint; uses file, codesign, otool, nm, and strings.
  • Heavy operation: spawns multiple processes per row; use specific paths, avoid wildcards on large trees.
  • Input paths are validated; only regular files are accepted.
  • file
  • hash