ContextQMD
Back to Beats

elastic_host_users

x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_host_users.md

9.4.01.8 KB
Original Source

% This file is generated! See ext/osquery-extension/cmd/gentables.

elastic_host_users

Host system user account information from /etc/passwd (e.g. when running in a container with hostfs mounted)

Platforms

  • ✅ Linux
  • ✅ macOS
  • ❌ Windows

Description

Query user account information from the host system's /etc/passwd file when running in a container. Reads from the path given by hostfs (default /hostfs); set ELASTIC_OSQUERY_HOSTFS to override. Use for container security auditing, host user inventory, and compliance checks.

Schema

ColumnTypeDescription
uidBIGINTUser ID (unsigned)
gidBIGINTDefault group ID (unsigned)
uid_signedBIGINTUser ID as int64 signed (for Apple systems)
gid_signedBIGINTDefault group ID as int64 signed (for Apple systems)
usernameTEXTUsername / login name
descriptionTEXTOptional user description / full name (GECOS field)
directoryTEXTUser's home directory path
shellTEXTUser's configured default shell
uuidTEXTUser's UUID (Apple) or SID (Windows); typically empty on Linux

Examples

Get all host users

sql
SELECT * FROM elastic_host_users;

Find user by username

sql
SELECT * FROM elastic_host_users WHERE username = 'root';

Find user by UID

sql
SELECT * FROM elastic_host_users WHERE uid = 1000;

List system users (UID < 1000)

sql
SELECT username, uid, shell, directory FROM elastic_host_users WHERE uid < 1000 ORDER BY uid;

Notes

  • Linux and macOS. Requires host filesystem mounted (e.g. -v /:/hostfs:ro).
  • Use ELASTIC_OSQUERY_HOSTFS to override the hostfs root (default /hostfs).
  • elastic_host_groups
  • users