WMI Classes

Querying Windows endpoints with WMI using Orbital

On top of existing osquery tables, Orbital allows you to query your endpoints using a familiar SQL syntax against a set of exposed Microsoft WMI Classes. Like existing osquery tables, classes can be queried for data using the SELECT statement, e.g.:

SELECT InstallState FROM Win32_OptionalFeature WHERE Name = 'TelnetClient';

Queries against WMI Classes can be combined with queries against other non-WMI Orbital tables (e.g. using JOIN) which allows for complex querying capabilities between multiple data sources.

The following exposed classes are outlined below with their corresponding WMI Namespace.


Note: Not all WMI namespaces are supported by all versions of Windows. Please refer to the Reference links provided in the class descriptions for more information on the minimum supported Windows version for each namespace.

Namespace: ROOT\CIMV2


Class: “Win32_Printer”

Class: “Win32_WinSat”

Class: “Win32_OSRecoveryConfiguration”

Class: “Win32_ShortcutFile”

Class: “Win32_Registry”

Class: “Win32_OptionalFeature”

Class: “Win32_NtLogEvent”

Note: Win32_NtLogEvent will attempt to query all Windows events that exist on the endpoint. For performant queries on endpoints with many Windows events it is strongly recommended to add a WHERE clause to limit the number of results, e.g. WHERE TimeGenerated >= 1597943950.

Class: “Win32_NtEventLogFile”

Class: “Win32_UserAccount”

Class: “Win32_SystemDriver”

Class: “Win32_Processor”

Class: “SoftwareLicensingService”

Class: “Win32_ShadowCopy”

Class: “Win32_Volume”

Class: “SoftwareLicensingProduct”

Namespace: Root\CIMV2\Security\MicrosoftTpm


Class: “Win32_Tpm”

Namespace: Root\SecurityCenter2


Class: “AntiVirusProduct”

Class: “FirewallProduct”

Namespace: Root\Microsoft\Windows\DeviceGuard


Class: “Win32_DeviceGuard”

Namespace: Root\Microsoft\SecurityClient


Class: “Malware”

Namespace: root\microsoft\windows\defender


Class: “MSFT_MpComputerStatus”

Namespace: root\cimv2\power


Class: “Win32_PowerPlan”

Return to Table of Contents