@theopolis we noticed some issues of apps not collected when using the darwin > apps table with osquery 2.1.2- seems launch services related. https://github.com/facebook/osquery/blob/master/osquery/tables/system/darwin/apps.mm#L243 issue is simple to replicate

osqueryi

executed as user you'll see apps like 1Password, Arq, Slack but with

sudo osqueryi

you don't . before I create an issue , was this once discussed with GregNeagle (taht issues was closed almost a year ago)