diff --git a/articles/enroll-hosts.md b/articles/enroll-hosts.md index 5ac91f0263..e5ed1669c8 100644 --- a/articles/enroll-hosts.md +++ b/articles/enroll-hosts.md @@ -210,15 +210,13 @@ Also, remember to replace both `AC_USERNAME` and `AC_PASSWORD` environment varia ### Grant full disk access to osquery on macOS -MacOS does not allow applications to access all system files by default. +macOS does not allow applications to access all system files by default. If you are using an MDM solution or Fleet's MDM features, one of which is required to deploy these profiles, you can deploy a "Privacy Preferences Policy Control" policy to grant fleetd or osquery that level of access. This is required to query for files located in protected paths as well as to use event tables that require access to the [EndpointSecurity API](https://developer.apple.com/documentation/endpointsecurity#overview), such as *es_process_events*. -#### Creating the configuration profile - ##### Obtaining identifiers If you use plain osquery, instructions are [available here](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/). diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 53815785ad..8663bbc98c 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -23973,7 +23973,7 @@ ], "evented": false, "cacheable": false, - "notes": "Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires a `JOIN` operation.\n\nQuery explanation:\n\n- The `safari_extensions` table has a row for each installed extension\n- Each row has a column with the `uid` of the user who installed the extension\n- Each `uid` from the `safari_extensions` table is matched in the `users` table to collect Safari extensions in the output data for all user accounts on the Mac by the `JOIN`\n\nLinks:\n\n- Apple dcoumentaion on Safari Extensions: https://support.apple.com/en-us/102343\n- CROSS JOIN SQLite tutorial: https://www.sqlitetutorial.net/sqlite-cross-join/\n- [Fleet documentation on joining against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)\n- Fleet users table: https://fleetdm.com/tables/users", + "notes": "Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires [giving osquery full disk access](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos) and a [`JOIN` against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table).\n\nQuery explanation:\n\n- The `safari_extensions` table has a row for each installed extension\n- Each row has a column with the `uid` of the user who installed the extension\n- Each `uid` from the `safari_extensions` table is matched in the `users` table to collect Safari extensions in the output data for all user accounts on the Mac by the `JOIN`\n\nLinks:\n\n- [Apple documentation on Safari Extensions](https://support.apple.com/en-us/102343)", "examples": "Collect Safari extensions for all Mac users:\n\n```\nSELECT * FROM users CROSS JOIN safari_extensions USING (uid);\n```", "columns": [ { diff --git a/schema/tables/safari_extensions.yml b/schema/tables/safari_extensions.yml index ea0d561b39..c03b644cdd 100644 --- a/schema/tables/safari_extensions.yml +++ b/schema/tables/safari_extensions.yml @@ -9,7 +9,7 @@ examples: |- SELECT * FROM users CROSS JOIN safari_extensions USING (uid); ``` notes: |- - Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires a `JOIN` operation. + Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires [giving osquery full disk access](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos) and a [`JOIN` against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table). Query explanation: @@ -19,7 +19,4 @@ notes: |- Links: - - Apple dcoumentaion on Safari Extensions: https://support.apple.com/en-us/102343 - - CROSS JOIN SQLite tutorial: https://www.sqlitetutorial.net/sqlite-cross-join/ - - [Fleet documentation on joining against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table) - - Fleet users table: https://fleetdm.com/tables/users + - [Apple documentation on Safari Extensions](https://support.apple.com/en-us/102343)