Generic details about keychain items. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.
Column | Type | Description |
---|---|---|
account | text | Optional item account |
comment | text | Optional keychain comment |
created | text | Date item was created |
description | text | Optional item description |
label | text | Generic item name |
modified | text | Date of last modification |
path | text | Path to keychain containing item |
pk_hash | text | Hash of associated public key (SHA1 of subjectPublicKey, see RFC 8520 4.2.1.2) |
type | text | Keychain item type (class) |
Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)
SELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';