so I went to audit if a particular EndpointSecurityFramework

Question

so I went to audit if a particular EndpointSecurityFramework SysExt agent process rhymes with CloudPsych was running with full disk access and found almost nothing actually enabled according to the access table in Library Application Support com apple TCC TCC db either their auto update or recent macOS updates have done a bangup job of screwing the pooch

allister · Answer

Also excuse me if I happen to be particularly annoyed that 1 it s been broken for over a month coinciding with their last auto update at least according to the modification on the row in the db for said agent and 2 for some reason I M THE ONE who gets a ticket when it s the vendor who could have been proactive about this and not have people trawling reddit for <https www reddit com r crowdstrike comments u9f2z6 20220422 cool query friday macos hostinfo and | cool query friday >