Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
c
CptOfEvilMinions
03/01/2021, 5:31 PMIs there a way to query a list of system extensions?
z
zwass
03/01/2021, 5:32 PMkernel_extensionsc
CptOfEvilMinions
03/01/2021, 5:34 PMNo, I am specifically looking for applications that are using the new Apple security framework.
I found this PR: https://github.com/osquery/osquery/pull/6863
It looks like the PR was merged into MAIN but I have to wait for the next Osquery release
z
zwass
03/01/2021, 5:37 PMGot it, looks like that PR ought to do what you're looking for.
💯 1
f
fritz
03/01/2021, 5:45 PM@CptOfEvilMinions Because it is a plist you should be able to query it using
plistc
CptOfEvilMinions
03/01/2021, 5:46 PM@fritz that worked!
f
fritz
03/01/2021, 5:46 PM👍
Happy to hear it