Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<@U1EUNPP63> <@U6EFFT5FG>
&gt; 1. Whether the EndpointSecurity Client must be a system extension?
&gt; My understanding is that EndpointSecurity require that clients run as root and have the entitlement, meaning there’s no specific requirement that the client be a system extension. This is in contrast to other subsystems, like system-wide NetworkExtensions, which must be packaged as system extensions.

I'm running it the same way in another project, here's the code: <https://github.com/zeek/zeek-agent/blob/master/components/zeekendpointsecurity/src/endpointsecurityconsumer.cpp>

Never experienced the issue mentioned in the tweet, mostly because I always stick to RAII :slightly_smiling_face:

I have to update the is_platform_binary handling there too :neutral_face: really misleading from the framework to put such an unreliable field in there

re: platform_binary, you can just report on `es_message-&gt;process-&gt;platform_binary` instead of the `event_exec-&gt;target-&gt;platform_binary` , that would solve it, right?

i would have to be called  parent_is_platform_binary then

I know that all these issues are just coming from kauth, but I wish they would have put more care into it

so you can get either a sha1 or a sha256 value

but either way it's always truncated at the length of the sha1

only way around that is to check on the file manually, but that's of course a race condition :neutral_face:

did you read the comments on `ESMessage.h` header, especially related to codesigning?

```If page content has been
 *   tampered with in the executable, we won't know until that page is paged in.  At that time, the
 *   process will have its CS_VALID bit removed and, if CS_KILL is set, the process will be killed,
 *   preventing any tampered code to be executed.  CS_KILL is generally set for platform binaries and
 *   for binaries having opted into the hardened runtime.  An ES client wishing to detect tampered
 *   code before it is paged in, for example already at exec time, can use the Security framework to
 *   do so, but should be cautious of the potentially significant performance cost of doing so.  The
 *   EndpointSecurity subsystem itself has no role in verifying the validity of code signatures.```