Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

sip_config

macOS System Integrity Protection (SIP) protects the Mac by preventing the execution of unauthorized code. The sip_config osquery table collects the current SIP status of a Mac.

Column	Type	Description
config_flag	text	The System Integrity Protection config flag
enabled	integer	1 if this configuration is enabled, otherwise 0
enabled_nvram	integer	1 if this configuration is enabled, otherwise 0

Example

Basic query:

SELECT * FROM sip_config;

This query displays the current SIP status (SIP is enabled if the value=1):

SELECT enabled FROM sip_config WHERE config_flag='sip';

Notes

SIP:

automatically authorizes apps users download from the App Store
authorizes apps developers notarize and distribute directly to users
prevents launching of other apps unless users or administrators modify "Gatekeeper" settings

Organizations that develop software for Apple operating systems on the Mac may allow users to disable SIP. Because SIP is a basic and critical macOS security protection it is important to monitor SIP status on Hosts.

Links:

Edit page