Fleet logo
Menu An icon indicating that interacting with this button will open the navigation menu.
Fleet logo An 'X' icon indicating that this can be interacted with to close the navigation menu.
Device management + MDM Orchestration + monitoring Software management + CVEs, usage, app library Integrations
Get started Built-in checks Raw data App library Tutorials & guides API SUPPORT Chat Contribute Release notes "Why is Fleet on my computer?" Get your license
Stories
What people are saying News Ask around Take a tour Meetups COMPANY Origins   (Fleet & osquery) The handbook Logos/artwork Why open source?
Pricing Try it yourself
Antivirus healthy
search

Antivirus healthy

Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.

Control

Create or edit a configuration profile with the following information:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>ConfigDataInstall</key>
      <true/>
      <key>CriticalUpdateInstall</key>
      <true/>
      <key>PayloadDisplayName</key>
      <string>Software Update</string>
      <key>PayloadIdentifier</key>
      <string>com.apple.SoftwareUpdate.C0292C9C-7506-4A51-9C19-52FF2DB632EC</string>
      <key>PayloadType</key>
      <string>com.apple.SoftwareUpdate</string>
      <key>PayloadUUID</key>
      <string>C0292C9C-7506-4A51-9C19-52FF2DB632EC</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Enable automatic system data files and security updates</string>
  <key>PayloadIdentifier</key>
  <string>com.fleetdm.enableSystemDataFilesAndSecurityUpdates.1C24BCAF-E18D-434B-B5D2-70F886F19912</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>1C24BCAF-E18D-434B-B5D2-70F886F19912</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Create or edit the following script and configure it to run when the check fails:

Check

Use the policy below to verify

SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;

Platform

macOS Windows Linux ChromeOS

Share

Share this article on Hacker News Share this article on LinkedIn Share this article on Twitter
Docs REST API Guides A pencil iconEdit page