maybe logged in users has context Anyway the actual thing th

Question

maybe logged in users has context Anyway the actual thing that someone WANTS me to pull info for is laptop lid opens and closes Which I kindof don t want there to be a table for but I may as well ask

seph · Answer

I would be surprised if you could discern laptop open closed events from the `last` table Or any kind of login tables

seph · Answer

I m not sure if it s exposed anywhere by the OS or anywhere osquery can read it

sharvil · Answer

Also lid open close doesn t imply logged in logged out per se I often have lid closed connected to external monitor

sharvil · Answer

macOS 13 EndpointSecurity does introduce new login logout events

allister · Answer

ORLY

allister · Answer

I don t even have the unified log extension to be able to pull Clamshell log events that should be close enough

seph · Answer

Next osquery probably has UAL built in

seph · Answer

And that extension is kinda dicy It s shelling out