hello, does anyone know why this query would work locally with

osqueryi

, but not when run in Fleet as a distributed query? I’ve tested other distributed queries on the host and it returns results

SELECT
  f.path
FROM
  file AS f
JOIN
  mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemDisplayName == 'ids.csv'";

Hi, see this thread, I had a similar issue https://osquery.slack.com/archives/C01DXJL16D8/p1692888286754639

ahh ok thanks, so if the query were scheduled, it also wouldn’t work…?

Oh it would have helped if I asked what OS you’re on as my issue is only relevant to MacOS 🤦

also on macOS! for the most part

Ok so yes, you need to give osquery full disk access and then it will work in fleet as an adhoc query and as a scheduled query

thank you, i will look into this

np! Hope it fixes the issue 🙂

so we aren’t set up with orbit yet… is there some other way we can enable full disk access?

If you don’t have MDM then I think you would have to do it manually, from memory I don’t think there’s a way to script enabling FDA

we use JAMF for MDM

Ok so in JAMF you should be able to enable FDA. I can’t help you with that though

in the

Automatically Granting Permissions (Silent Installs)

section

Yeah that’s it