Looking for some pointers here (still learning SQL), I’m trying to exclude certain criteria from returning results within a policy, for example I only want to check if encryption is enabled for physical linux devices and exclude VM’s, a standalone query excludes the criteria ‘VirtualBox’, ‘Parallels Virtual Platform’ however the policy is returning YES/NO results for VM’s:

SELECT EXISTS(SELECT * FROM system_info WHERE board_model not in ('VirtualBox', 'Parallels Virtual Platform') AND (select 1 from disk_encryption WHERE encrypted = '1' AND name like '/dev/dm-1')) as is_desktop_encrypted;

Zach helped me out with something similar a while ago, so I should pay it forward 🙂 Here is an example of a simply policy query I have to check that the disk is encrypted on windows, but only if it's a laptop.

Thanks y’all, appreciate the pointers! will definitely take a look at the teams functionality