Browse Live Discover and Response Queries by Category
Approved

[Answered in Comments]

Is there a way to check what applications are installed on MAC endpoints via Sophos Central?

Is there a way to check what applications are installed on  MAC endpoints via Sophos Central?

I can see queries to pull-out installed application list from Windows endpoints.

Is there any query for MAC endpoints

Subash Chandran
Parents

  • Hi Subash,

    Thanks for reaching out to the Sophos Community Forum. 

    You can find further details on the tables and data collected on the following page.  - doc.sophos.com/.../index.html 

    We use the open source "osquery" in addition to data collected specifically for XDR and threat detection purposes. A basic query you can use for macOS devices is as follows:
      

    SELECT 
  name,
  bundle_identifier, 
  display_name,
  last_opened_time
FROM apps

Comment

  • Hi Subash,

    Thanks for reaching out to the Sophos Community Forum. 

    You can find further details on the tables and data collected on the following page.  - doc.sophos.com/.../index.html 

    We use the open source "osquery" in addition to data collected specifically for XDR and threat detection purposes. A basic query you can use for macOS devices is as follows:
      

    SELECT 
  name,
  bundle_identifier, 
  display_name,
  last_opened_time
FROM apps

Children
No Data
Unfiltered HTML