https://github.com/osquery/osquery logo
#sql
Title
# sql
j

Julian Scala

10/15/2020, 8:29 PM
Any example of a query to get the filevault service status on MacOS?
h

harroldhino

10/15/2020, 10:27 PM
Copy code
SELECT d.encrypted FROM mounts m JOIN disk_encryption d ON m.device_alias = d.name WHERE m.path = '/';
Does that work?
j

Julian Scala

10/15/2020, 10:28 PM
Yah, thats what I am using, just facing a weird scenario where unencrypted Macs show as encrypted on that query this is fine
There is a follow up on this in the #macos channel
Thanks though!
h

harroldhino

10/15/2020, 10:31 PM
Gotcha! To be honest, I was just excited to come across a question that I might be able to answer. I’m in disbelief that I was (partially) correct.
☺️ 1
j

Julian Scala

10/15/2020, 10:31 PM
Hahah! No worries at all, the intention is what counts. So appreciate your help!
I also thought the query I built was a disaster, thats why I throw the question here. You got it right and if in the future someone looks for a Filevault query, this will come up!
h

harroldhino

10/16/2020, 12:31 AM
brb, telling my entire company
😂 1
6 Views