allister11/16/2021, 8:22 AM
osquery> select count(*) from apps join mdls on mdls.path = apps.path where mdls.key = "kMDItemExecutableArchitectures" and mdls.value not like "arm64%"; count(*) = 44
seph11/18/2021, 1:59 AM
allister11/18/2021, 2:22 AM
seph11/18/2021, 4:15 PM
in osqueryi and see how different they look. You can also get into queryy planning.