mikermcneil
01/28/2023, 12:17 AMxprotect_meta
table might be wrong:
https://fleetdm.com/tables/xprotect_meta
But when I query some Macs, I see "com.viewanysearch", which looks pretty sketchy, with its minimum version listed as "any". Should this actually say:- The minimum allowed plugin version.min_version
- The minimum banned plugin versionmin_version
com.anysearch
thing which is presumably effectively a virus)zwass
01/28/2023, 12:39 AMmikermcneil
01/28/2023, 12:54 AMzwass
01/28/2023, 12:55 AMmikermcneil
01/28/2023, 12:57 AMmin_version
is actually min_version blocked
Looks like it's set for some other random things like flash player and Java:zwass
01/28/2023, 12:58 AMExtensionBlacklist
entries (which is where the anysearch
is). They do set it for PluginBlacklist
where it might actually be correct as documented.mikermcneil
01/28/2023, 1:00 AMzwass
01/28/2023, 1:00 AM