ContextQMD
Back to Beats

host_users

x-pack/osquerybeat/ext/osquery-extension/docs/views/host_users.md

9.4.01.5 KB
Original Source

% This file is generated! See ext/osquery-extension/cmd/gentables.

host_users

(Deprecated.) Backward-compatible view over elastic_host_users; use elastic_host_users instead.

Platforms

  • ✅ Linux
  • ✅ macOS
  • ❌ Windows

Description

Deprecated. This view is deprecated in favor of the elastic_host_users table. It exists only for backward compatibility (SELECT * FROM elastic_host_users). Use elastic_host_users directly in new use cases.

Schema

ColumnTypeDescription
uidBIGINTUser ID (unsigned)
gidBIGINTDefault group ID (unsigned)
uid_signedBIGINTUser ID as int64 signed (for Apple systems)
gid_signedBIGINTDefault group ID as int64 signed (for Apple systems)
usernameTEXTUsername / login name
descriptionTEXTOptional user description / full name (GECOS field)
directoryTEXTUser's home directory path
shellTEXTUser's configured default shell
uuidTEXTUser's UUID (Apple) or SID (Windows); typically empty on Linux

Required Tables

This view requires the following tables to be available:

  • elastic_host_users

View Definition

sql
CREATE VIEW host_users AS
SELECT * FROM elastic_host_users;

Examples

Query host users (same as elastic_host_users)

sql
SELECT * FROM host_users;

Notes

  • Deprecated in favor of elastic_host_users; use the table directly for new queries.
  • elastic_host_users
  • elastic_host_groups