ok think i found it
```
osquery> select * from ...
# macosm
Mark
09/07/2018, 8:30 PMok think i found it
Copy code
osquery> select * from plist where path = '/Library/Preferences/com.apple.SoftwareUpdate.plist';
+---------------------------------+--------+-----------------+-----------------------------------------------------+
| key | subkey | value | path |
+---------------------------------+--------+-----------------+-----------------------------------------------------+
| LastUpdatesAvailable | | 0 | /Library/Preferences/com.apple.SoftwareUpdate.plist |
| LastRecommendedUpdatesAvailable | | 0 | /Library/Preferences/com.apple.SoftwareUpdate.plist |