Harrison
08/31/2022, 4:22 PMLuke Heath
08/31/2022, 6:30 PM/Library/Application\ Support/com.apple.TCC/TCC.db
and user settings in /Users/username/Library/Application Support/com.apple.TCC/TCC.db
- you could use ATC (auto table construction) to parse it if your osquery agent has full disk access. Your mileage may vary on compatibility across macOS versions.
Kolide had a really good post on this a few years ago: https://www.kolide.com/blog/macos-catalina-osqueryHarrison
08/31/2022, 6:30 PM