The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Discover Mounted Drives

Description: Show mounted file systems

What The Data Shows: All mounted drives per endpoint

SQL: 

SELECT device,path 
FROM mounts;

 

 

0 Votes
3 Comments
Query_Admin
Community Manager
Community Manager
Status changed to: Approved
 
mrpeters22
Contributor III

I'm not seeing a table by the name of 'mounts' in the current osquery schema (confer\blades\livequery\osqueryi.exe > .tables)

jnelson
Carbon Black Employee
Status changed to: Approved

The mounts table is only available for Linux and Mac. For Windows you would look at logical_drives.