Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Fixing bug and bumping versions for AV check on macOS (#7522)

Browse Source 
The policy had been pasted in `constants.ts` wrong - replacing with the right one, and while I'm here, bumping the versions.
This commit is contained in:
Guillaume Ross
2022-09-01 14:28:30 -04:00
committed by GitHub
parent 15a7f8a18c
commit 54569281de
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/01-Using-Fleet/standard-query-library/standard-query-library.yml
+2 -2
View File
@@ -609,14 +609,14 @@ apiVersion: v1
kind: policy
spec:
name: Antivirus healthy (macOS)
query: SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2155) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.88)) WHERE score == 1;
query: SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;
description: Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.
resolution:
To enable automatic security definition updates, on the failing device, select System
Preferences > Software Update > Advanced > Turn on Install system data files and security
updates.
platforms: macOS
tags: compliance, malware, hardening, built-in
tags: compliance, malware, hardening, built-in, template
platform: darwin
contributors: GuillaumeRoss
---
frontend/utilities/constants.ts
+1 -1
View File
@@ -27,7 +27,7 @@ export const DEFAULT_POLICIES = [
{
key: 2,
query:
"SELECT 1 FROM managed_policies WHERE domain = 'com.apple.Terminal' AND name = 'SecureKeyboardEntry' AND value = 1 LIMIT 1;",
"SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;",
name: "Antivirus healthy (macOS)",
description:
"Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.",