osquery> .mode line
osquery> SELECT CASE
    ...>     WHEN
    ...>            (select value from plist
    ...>            where path = "/Library/Application Support/com.apple.TCC/MDMOverrides.plist"
    ...>            and key = "io.osquery.agent"
    ...>            and subkey = "kTCCServiceSystemPolicyAllFiles/Allowed") = 1 THEN 'enabled'
    ...>     ELSE 'disabled'
    ...> END AS falconFDAAllowed;
falconFDAAllowed = enabled