<#C01DXJL16D8|fleet>
How can I check the antivirus...
# fleetw
waleed
07/31/2023, 11:32 AM#fleet
How can I check the antivirus and firewall is enabled in host (Linux or Mac) ?
I found the query for windows which works perfectly i.e (select * from windows_security_center)
z
Zay Hanlon
07/31/2023, 2:28 PMHello @waleed - Many queries can be found in our documentation at: https://fleetdm.com/queries/
For macOS:
https://fleetdm.com/queries/antivirus-healthy-mac-os
Zay Hanlon
07/31/2023, 2:28 PMk
Keith Swagler
07/31/2023, 2:54 PMI'll add a bit of context to those queries. Mac and Linux don't have a central config location like the Windows registry so while the Mac one for example looks for Xprotect, If you are looking for monitoring a third party EDR/AV like Crowdstrike, SentinelOne, etc you will probably want to look for those processed like the Linux query does
Keith Swagler
07/31/2023, 2:55 PMand of course, just because the process is running, doesn't mean it's necessarily "healthy", if you want to be really sure you should check to make sure logs are coming in from the agents you expect
w
waleed
07/31/2023, 3:01 PMAlright! and thanks for your guidance
@Zay Hanlon @Keith Swagler
2 Views