Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
authorization_mechanisms
macOS Authorization mechanisms database.
Column | Type | Description |
---|---|---|
entry | text | The whole string entry |
label | text | Label of the authorization right |
mechanism | text | Name of the mechanism that will be called |
plugin | text | Authorization plugin name |
privileged | text | If privileged it will run as root, else as an anonymous user |
Discover privileged macOS authorization mechanisms, which could include third party software. Finding third party software using this means it is likely an important piece of software that should be kept very up to date.
SELECT * FROM authorization_mechanisms WHERE privileged='true';