Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

since osquery is also an endpointsecurity sysext now this would affect osquery should a user re-enroll in mdm or if the sysext profile is ever replaced

Slight correction -- osquery is not yet a systemextension

it's a minimal app bundle shim, so that endpointsecurity works correctly with pppc profiles and such

Does that mean this wouldn't effect osquery yet?

you'd have to use `OSSystemExtensionRequest activationRequestForExtension:queue:` first

Was it mentioned in the 5.0.0 release notes and got removed later? I guess I missed some conversation and thought EndpointSecurity was somewhat functional

thanks for clarifying :slightly_smiling_face:

EndpointSecurity is still functional :slightly_smiling_face: es_client has a special case where it need not be a system extension

our previous thread  <https://osquery.slack.com/archives/C08VA3XQU/p1590519130180100> :grinning:

And here: <https://osquery.slack.com/archives/C08VA8R6F/p1631732498011100?thread_ts=1631730958.010300&amp;cid=C08VA8R6F>

It's a bit weird. that apple has this split