Osquery - Macos Threads

Channels

Topic	Authors	Views	Replies	Activity
@MaxosxOsquery you can use the `extended_attributes` table to look for `where_froms` data	m	0	3	1 year ago
I'm pretty sure there's a way to tell what's registered to open on login, which I have a shitty Electron app doing (who doesn't, amirite) - anyone know what table might have that off the top of their collective heads?	f	0	4	1 year ago
Hi, wonder if anyone has got xprotect_reports table working? I was testing a binary that would trigger xprotect to reject, but xprotect_reports table still empty, why...	z	0	1	1 year ago
An interesting item I noticed, `block_devices` returns the label `Untitled` for devices that do have names according to Disk Utility:	f	1	2	1 year ago
And I assume you are using a recent version of osquery? Older versions had performance issues on macos, specifically with using the users table.		0	3	1 year ago
when building osquery from source, is it possible to customise the build script to add postflight scripts (eg move the plist & load it) if so, where is the build script?	a	1	3	2 years ago
https://developer.apple.com/wwdc20/10159 the video on EndpointSecurity is available for viewing	b	0	2	2 years ago
I want to help (again) because I'm finally catching up to being negligent with code I had pushed... starting with a TCC profile that I was thinking I would need to check chrome extensions and stuff? I don't see one in Re...	a	0	2	2 years ago
👋 Question for the room - do you need to restart osqueryd after giving osquery full disk access via Privacy Preferences Policy Control config profile?		1	3	2 years ago
i noticed `/etc/security/audit_control` was reverted back to the default on my mac in the past week or so. i suspect this occurred when i updated from 10.15.4 to 10.15.5 (similar to how `/var/log/osquery/` gets blown awa...	m	0	2	2 years ago

f
@MaxosxOsquery you can use the
extended_attributes
table to look for
where_froms
data
3 Replies
1 year ago
a
I'm pretty sure there's a way to tell what's registered to open on login, which I have a shitty Electron app doing (who doesn't, amirite) - anyone know what table might have that off the top of their collective heads?
4 Replies
1 year ago
z
Hi, wonder if anyone has got *xprotect_reports* table working? I was testing a binary that would trigger xprotect to reject, but xprotect_reports table still empty, why...
1 Replies
1 year ago
f
An interesting item I noticed,
block_devices
returns the label
Untitled
for devices that *do have* names according to Disk Utility:
2 Replies
1 year ago
And I assume you are using a recent version of osquery? Older versions had performance issues on macos, specifically with using the users table.
3 Replies
1 year ago
a
when building osquery from source, is it possible to customise the build script to add postflight scripts (eg move the plist & load it) if so, where is the build script?
3 Replies
2 years ago
https://developer.apple.com/wwdc20/10159 the video on EndpointSecurity is available for viewing
2 Replies
2 years ago
a
I want to help (again) because I'm finally catching up to being negligent with code I had pushed... starting with a TCC profile that I was thinking I would need to check chrome extensions and stuff? I don't see one in Re...
2 Replies
2 years ago
👋 Question for the room - do you need to restart osqueryd after giving osquery full disk access via Privacy Preferences Policy Control config profile?
3 Replies
2 years ago
m
i noticed
/etc/security/audit_control
was reverted back to the default on my mac in the past week or so. i suspect this occurred when i updated from 10.15.4 to 10.15.5 (similar to how
/var/log/osquery/
gets blown awa...
2 Replies
2 years ago