How to List BIOS Platforms Across All Mac, Windows, and Linux Devices
Using Kolide, you can easily view and query BIOS Platforms across your fleet.
Introduction
BIOS (Basic Input/Output System) is the firmware used by a computer to perform which initializes hardware at boot and executes runtime services for the OS and its programs. It is preinstalled on all devices and it is the first software which runs at boot. The BIOS of a device is separate from its Operating System and has its own metadata such as version and revision.
What BIOS Platform Data Can Kolide Collect?
Kolide's endpoint agent bundles in osquery to efficiently collect BIOS Platforms from Mac, Windows, and Linux devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.
Kolide meticulously documents every piece of data returned so you can understand the results.
BIOS Platforms Schema
| Column | Type | Description | |
|---|---|---|---|
| id | Primary Key |
Unique identifier for the object |
|
| device_id | Foreign Key |
Device associated with the entry |
|
| device_name | Text |
Display name of the device associated with the entry |
|
| address | Text |
Relative address of firmware mapping |
|
| extra | Text |
Platform-specific additional information |
|
| platform_date | Date |
Self-reported platform code update date |
|
| revision | Text |
BIOS major and minor revision |
|
| size | Bigint |
Size of firmware in bytes |
|
| vendor | Text |
Platform code vendor |
|
| version | Text |
Platform code version |
|
| collected_at | Timestamp |
Time the row of data was first collected in the database |
|
| updated_at | Timestamp |
Time the row of data was last changed in the database |
|
What Can You Do With This Information?
Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:
SELECT
COUNT(*) AS frequency,
extra,
vendor,
version
FROM device_bios_platforms
GROUP BY extra, vendor, version
ORDER BY frequency DESC| extra | vendor | version | frequency |
|---|---|---|---|
| MBP133.88Z.F000.B00.2201111532; MBP133; 451.100.34.0.0; root@4l5fn; Tue Jan 11 15:32:43 2022; 451.100.34 (B&I); F000_B00; Official Build, RELEASE; clang-1316.0.18.7 | Apple Inc. | 451.100.34.0.0 | 3 |
| MBP161.88Z.F000.B00.2203172311; MBP161; 1731.100.130.0.0; root@lxqb5; Thu Mar 17 23:11:34 2022; 1731.100.130 (B&I); F000_B00; Official Build, RELEASE; clang-1316.0.20.10 | Apple Inc. | 1731.100.130.0.0 (iBridge: 19.16.14243.0.0,0) | 2 |
| IMP11.88Z.F000.B00.2203172305; IMP11; 1731.100.130.0.0; root@rf27b; Thu Mar 17 23:05:13 2022; 1731.100.130 (B&I); F000_B00; Official Build, RELEASE; clang-1316.0.20.10 | Apple Inc. | 1731.100.130.0.0 (iBridge: 19.16.14243.0.0,0) | 2 |
| MBP161.88Z.F000.B00.2110032049; MBP161; 1715.40.15.0.0; root@bb-g8-pdb23; Sun Oct 3 20:49:09 2021; 1715.40.15 (B&I); F000_B00; Official Build, RELEASE; clang-1300.0.29.1 | Apple Inc. | 1715.40.15.0.0 (iBridge: 19.16.10548.0.0,0) | 2 |
| MBP143.88Z.F000.B00.2101051910; MBP143; 429.80.1.0.0; root@osx400; Tue Jan 5 19:10:34 2021; 429.80.1 (B&I); F000_B00; Official Build, RELEASE; clang-1200.0.30.4 | Apple Inc. | 429.80.1.0.0 | 2 |
Why Should I Collect BIOS Platforms?
Administrators may rely on BIOS information to identify devices with unpatched vulnerabilities or otherwise out of date firmware. BIOS info can also be useful for determining what features may be available on a given device and also for device grouping purposes.
End-User Privacy Consideration
Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.
When you use Kolide to list BIOS Platform data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.
