From cc9f8e4891d6b8755678ac921fe725bd8888d14a Mon Sep 17 00:00:00 2001 From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Date: Thu, 6 Aug 2026 14:08:21 -0500 Subject: [PATCH] Dogfood: drop platform prefix from policy names (#50658) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Related issue:** NA The Fleet UI now displays a policy's targeted platform, so repeating it in the policy name is redundant. This strips the leading `macOS - ` / `Windows - ` / `Linux - ` from all 84 prefixed policies in `it-and-security`. ## Collisions GitOps rejects duplicate policy names within a fleet ([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)), and the Workstations fleet includes macOS, Windows, and Linux policies together. 14 stripped names would collide, so for those the platform moves to a trailing suffix instead of being dropped: | Before | After | |---|---| | `macOS - Gatekeeper enabled` | `Gatekeeper enabled` | | `Windows - Secure Boot enabled` | `Secure Boot enabled` | | `Linux - Removable storage is read-only` | `Removable storage is read-only` | | `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)` | | `Windows - Disk encryption enabled` | `Disk encryption enabled (Windows)` | | `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)` | 49 policies lose the platform entirely; 35 keep it as a suffix. The 14 suffixed names are: Disk encryption enabled, Sufficient disk space available, User .npmrc min-release-age at least 0.5 days, 1Password installed, Battery healthy, and the 9 patch policies that exist for both macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom, Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader). Also updates the descriptions of `macos-screen-lock-exclusions` and `windows-screen-lock-exclusions`, which quote policy names. ## Notes for the reviewer - **This is destructive on apply.** GitOps matches policies by name, so applying this deletes the 84 existing policies and creates new ones. Policy pass/fail history and host results reset. Automations defined in the policy YAML (calendar events, install/script triggers) carry over, but anything referencing these names outside the repo — saved filters, dashboards, Slack workflows — needs updating separately. - `tools/fleet-slackbot/system-prompt.js:338` still documents the ` - ` convention, and the `fleetctl new` macOS template still ships a prefixed name. Both left alone intentionally — out of scope for dogfood config. - Four policy files appear unused by any fleet and were renamed only for consistency: `lib/{macos,windows}/policies/update-claude.yml` and `update-slack.yml`. Their names duplicate entries already in `patch-fleet-maintained-apps.yml` for the same platform. Worth deleting in a follow-up. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. N/A — dogfood GitOps config only, no product code changes. ## Testing - [x] QA'd all new/changed functionality manually Verified locally: - No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere under `it-and-security/`. - Every fleet passes the same uniqueness rule GitOps enforces — Workstations resolves to 78 policies with 0 duplicate names; all other fleets unchanged. - All 73 touched/related YAML files parse. - The diff touches only `- name:` lines plus the two label descriptions. --- .../labels/macos-screen-lock-exclusions.yml | 2 +- .../labels/windows-screen-lock-exclusions.yml | 2 +- .../npm-user-npmrc-min-release-age.yml | 6 +- .../check-fleet-desktop-extension-enabled.yml | 2 +- .../linux/policies/disk-encryption-check.yml | 2 +- .../lib/linux/policies/disk-space-check.yml | 2 +- .../policies/removable-storage-read-only.yml | 2 +- .../sshd-permitrootlogin-restricted.yml | 2 +- .../1password-emergency-kit-check.yml | 2 +- .../macos/policies/1password-installed.yml | 2 +- .../all-software-updates-installed.yml | 2 +- .../macos/policies/battery-health-check.yml | 2 +- .../macos/policies/disk-encryption-check.yml | 2 +- .../lib/macos/policies/disk-space-check.yml | 2 +- .../lib/macos/policies/firewall-enabled.yml | 2 +- .../lib/macos/policies/gatekeeper-enabled.yml | 2 +- .../install-fleet-desktop-launch-agent.yml | 2 +- .../macos/policies/install-nudge-assets.yml | 2 +- .../policies/install-santa-extension.yml | 2 +- .../lib/macos/policies/latest-macos.yml | 2 +- .../policies/local-admin-count-reasonable.yml | 2 +- .../lib/macos/policies/nudge-installed.yml | 2 +- .../policies/patch-fleet-maintained-apps.yml | 68 +++++++++---------- .../macos/policies/remote-login-disabled.yml | 2 +- ...nta-endpoint-security-extension-active.yml | 2 +- .../macos/policies/screen-lock-inactivity.yml | 2 +- .../lib/macos/policies/sip-enabled.yml | 2 +- .../lib/macos/policies/update-claude.yml | 2 +- .../lib/macos/policies/update-safari.yml | 2 +- .../lib/macos/policies/update-slack.yml | 2 +- .../windows/policies/1password-installed.yml | 2 +- .../all-windows-updates-installed.yml | 2 +- .../antivirus-signatures-up-to-date.yml | 2 +- .../windows/policies/battery-health-check.yml | 2 +- .../policies/disk-encryption-check.yml | 2 +- .../lib/windows/policies/disk-space-check.yml | 2 +- .../policies/patch-fleet-maintained-apps.yml | 18 ++--- .../policies/remote-desktop-disabled.yml | 2 +- .../screen-lock-timeout-configured.yml | 2 +- .../windows/policies/secure-boot-enabled.yml | 2 +- .../lib/windows/policies/update-claude.yml | 2 +- .../lib/windows/policies/update-slack.yml | 2 +- .../windows-defender-compliance-check.yml | 2 +- 43 files changed, 86 insertions(+), 86 deletions(-) diff --git a/it-and-security/lib/all/labels/macos-screen-lock-exclusions.yml b/it-and-security/lib/all/labels/macos-screen-lock-exclusions.yml index 30d1cb6907..4c6d72bdde 100644 --- a/it-and-security/lib/all/labels/macos-screen-lock-exclusions.yml +++ b/it-and-security/lib/all/labels/macos-screen-lock-exclusions.yml @@ -1,6 +1,6 @@ - name: macOS screen lock exclusions description: | - Hosts in this label are excluded from the "macOS - Screen lock after inactivity (15 minutes or less)" + Hosts in this label are excluded from the "Screen lock after inactivity (15 minutes or less)" policy and the corresponding screen-lock-inactivity.mobileconfig configuration profile. Add Fleet host IDs below to exclude a host (hardware_serial or uuid also work). label_membership_type: manual diff --git a/it-and-security/lib/all/labels/windows-screen-lock-exclusions.yml b/it-and-security/lib/all/labels/windows-screen-lock-exclusions.yml index 70b4f9156c..830f7e258b 100644 --- a/it-and-security/lib/all/labels/windows-screen-lock-exclusions.yml +++ b/it-and-security/lib/all/labels/windows-screen-lock-exclusions.yml @@ -1,6 +1,6 @@ - name: Windows screen lock exclusions description: | - Hosts in this label are excluded from the "Windows - Interactive logon screen lock timeout configured" + Hosts in this label are excluded from the "Interactive logon screen lock timeout configured" policy and the corresponding "Screen lock timeout.xml" configuration profile. Add Fleet host IDs below to exclude a host (hardware_serial or uuid also work). label_membership_type: manual diff --git a/it-and-security/lib/all/policies/npm-user-npmrc-min-release-age.yml b/it-and-security/lib/all/policies/npm-user-npmrc-min-release-age.yml index f06839c035..b89010f9d9 100644 --- a/it-and-security/lib/all/policies/npm-user-npmrc-min-release-age.yml +++ b/it-and-security/lib/all/policies/npm-user-npmrc-min-release-age.yml @@ -1,4 +1,4 @@ -- name: macOS - User .npmrc min-release-age at least 0.5 days +- name: User .npmrc min-release-age at least 0.5 days (macOS) query: | SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM users u @@ -77,7 +77,7 @@ run_script: path: ../scripts/configure-npmrc-min-release-age.sh -- name: Linux - User .npmrc min-release-age at least 0.5 days +- name: User .npmrc min-release-age at least 0.5 days (Linux) query: | SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM users u @@ -154,7 +154,7 @@ run_script: path: ../scripts/configure-npmrc-min-release-age.sh -- name: Windows - User .npmrc min-release-age at least 0.5 days +- name: User .npmrc min-release-age at least 0.5 days (Windows) query: | SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM users u diff --git a/it-and-security/lib/linux/policies/check-fleet-desktop-extension-enabled.yml b/it-and-security/lib/linux/policies/check-fleet-desktop-extension-enabled.yml index c5d4859688..317d1b6194 100644 --- a/it-and-security/lib/linux/policies/check-fleet-desktop-extension-enabled.yml +++ b/it-and-security/lib/linux/policies/check-fleet-desktop-extension-enabled.yml @@ -1,4 +1,4 @@ -- name: Linux - Fleet Desktop extensions enabled +- name: Fleet Desktop extensions enabled critical: false description: This policy checks if the extension required for Fleet Desktop is installed and enabled. resolution: | diff --git a/it-and-security/lib/linux/policies/disk-encryption-check.yml b/it-and-security/lib/linux/policies/disk-encryption-check.yml index c77c51ac27..8b612c5f2a 100644 --- a/it-and-security/lib/linux/policies/disk-encryption-check.yml +++ b/it-and-security/lib/linux/policies/disk-encryption-check.yml @@ -1,4 +1,4 @@ -- name: Linux - Disk encryption enabled +- name: Disk encryption enabled (Linux) query: SELECT 1 FROM mounts m, disk_encryption d WHERE m.device_alias = d.name AND d.encrypted = 1 AND m.path = '/'; critical: false description: This policy checks if disk encryption is enabled. diff --git a/it-and-security/lib/linux/policies/disk-space-check.yml b/it-and-security/lib/linux/policies/disk-space-check.yml index 7170de5036..17e8e05d8c 100644 --- a/it-and-security/lib/linux/policies/disk-space-check.yml +++ b/it-and-security/lib/linux/policies/disk-space-check.yml @@ -1,4 +1,4 @@ -- name: Linux - Sufficient disk space available +- name: Sufficient disk space available (Linux) query: SELECT 1 FROM mounts WHERE path = '/' AND CAST(blocks_available AS REAL) / blocks > 0.10; critical: false description: >- diff --git a/it-and-security/lib/linux/policies/removable-storage-read-only.yml b/it-and-security/lib/linux/policies/removable-storage-read-only.yml index cde8bd4667..7afe8471dc 100644 --- a/it-and-security/lib/linux/policies/removable-storage-read-only.yml +++ b/it-and-security/lib/linux/policies/removable-storage-read-only.yml @@ -1,4 +1,4 @@ -- name: Linux - Removable storage is read-only +- name: Removable storage is read-only critical: false description: Enforces read-only access to USB removable storage (USB sticks, external HDD/SSD presented as removable, SD cards) on Linux hosts via a udev rule. resolution: | diff --git a/it-and-security/lib/linux/policies/sshd-permitrootlogin-restricted.yml b/it-and-security/lib/linux/policies/sshd-permitrootlogin-restricted.yml index 366692bbd6..1cdd71ccde 100644 --- a/it-and-security/lib/linux/policies/sshd-permitrootlogin-restricted.yml +++ b/it-and-security/lib/linux/policies/sshd-permitrootlogin-restricted.yml @@ -1,4 +1,4 @@ -- name: Linux - SSH PermitRootLogin not set to yes +- name: SSH PermitRootLogin not set to yes query: |- SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM augeas diff --git a/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml b/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml index 0264443cc6..71ac649128 100644 --- a/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml +++ b/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml @@ -1,4 +1,4 @@ -- name: macOS - No 1Password emergency kit stored in desktop, documents, or downloads folders +- name: No 1Password emergency kit stored in desktop, documents, or downloads folders query: SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM file WHERE diff --git a/it-and-security/lib/macos/policies/1password-installed.yml b/it-and-security/lib/macos/policies/1password-installed.yml index d7f2a07261..a704f167b6 100644 --- a/it-and-security/lib/macos/policies/1password-installed.yml +++ b/it-and-security/lib/macos/policies/1password-installed.yml @@ -1,4 +1,4 @@ -- name: macOS - 1Password installed +- name: 1Password installed (macOS) query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.1password.1password'; # install_software: # fleet_maintained_app_slug: 1password/darwin diff --git a/it-and-security/lib/macos/policies/all-software-updates-installed.yml b/it-and-security/lib/macos/policies/all-software-updates-installed.yml index 1daddc1934..c16576dae4 100644 --- a/it-and-security/lib/macos/policies/all-software-updates-installed.yml +++ b/it-and-security/lib/macos/policies/all-software-updates-installed.yml @@ -1,4 +1,4 @@ -- name: macOS - All available software updates installed +- name: All available software updates installed query: SELECT 1 FROM software_update WHERE software_update_required = 0; critical: false description: This Mac may have outdated system software, which could lead to security vulnerabilities, performance issues, and incompatibility with other systems. diff --git a/it-and-security/lib/macos/policies/battery-health-check.yml b/it-and-security/lib/macos/policies/battery-health-check.yml index 3b5902d5d2..91de6f8e39 100644 --- a/it-and-security/lib/macos/policies/battery-health-check.yml +++ b/it-and-security/lib/macos/policies/battery-health-check.yml @@ -1,4 +1,4 @@ -- name: macOS - Battery healthy +- name: Battery healthy (macOS) query: |- SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM battery diff --git a/it-and-security/lib/macos/policies/disk-encryption-check.yml b/it-and-security/lib/macos/policies/disk-encryption-check.yml index 0691687b80..c592404f1b 100644 --- a/it-and-security/lib/macos/policies/disk-encryption-check.yml +++ b/it-and-security/lib/macos/policies/disk-encryption-check.yml @@ -1,4 +1,4 @@ -- name: macOS - Disk encryption enabled +- name: Disk encryption enabled (macOS) query: SELECT 1 FROM filevault_status WHERE status LIKE '%on%'; critical: false description: This policy checks if disk encryption is enabled. diff --git a/it-and-security/lib/macos/policies/disk-space-check.yml b/it-and-security/lib/macos/policies/disk-space-check.yml index 2f2a2bf312..21f9ddfb01 100644 --- a/it-and-security/lib/macos/policies/disk-space-check.yml +++ b/it-and-security/lib/macos/policies/disk-space-check.yml @@ -1,4 +1,4 @@ -- name: macOS - Sufficient disk space available +- name: Sufficient disk space available (macOS) query: SELECT 1 FROM mounts WHERE path = '/' AND CAST(blocks_available AS REAL) / blocks > 0.10; critical: false description: >- diff --git a/it-and-security/lib/macos/policies/firewall-enabled.yml b/it-and-security/lib/macos/policies/firewall-enabled.yml index a2a0f8c667..63be2b2198 100644 --- a/it-and-security/lib/macos/policies/firewall-enabled.yml +++ b/it-and-security/lib/macos/policies/firewall-enabled.yml @@ -1,4 +1,4 @@ -- name: macOS - Application firewall enabled +- name: Application firewall enabled query: SELECT 1 FROM alf WHERE global_state >= 1; critical: false description: |- diff --git a/it-and-security/lib/macos/policies/gatekeeper-enabled.yml b/it-and-security/lib/macos/policies/gatekeeper-enabled.yml index e28e19e57c..b0f20df225 100644 --- a/it-and-security/lib/macos/policies/gatekeeper-enabled.yml +++ b/it-and-security/lib/macos/policies/gatekeeper-enabled.yml @@ -1,4 +1,4 @@ -- name: macOS - Gatekeeper enabled +- name: Gatekeeper enabled query: SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1; critical: false description: |- diff --git a/it-and-security/lib/macos/policies/install-fleet-desktop-launch-agent.yml b/it-and-security/lib/macos/policies/install-fleet-desktop-launch-agent.yml index 1a87036c4e..fb17412c49 100644 --- a/it-and-security/lib/macos/policies/install-fleet-desktop-launch-agent.yml +++ b/it-and-security/lib/macos/policies/install-fleet-desktop-launch-agent.yml @@ -1,4 +1,4 @@ -- name: macOS - Fleet Desktop.app launch agent installed +- name: Fleet Desktop.app launch agent installed query: SELECT 1 FROM file WHERE path = '/Library/LaunchAgents/com.fleetdm.fleet-desktop-hidden.plist' LIMIT 1; critical: false description: Ensures the Fleet Desktop.app launch agent plist is present on disk after the MDM profile is delivered. diff --git a/it-and-security/lib/macos/policies/install-nudge-assets.yml b/it-and-security/lib/macos/policies/install-nudge-assets.yml index 1281a1fcc0..15bfbd50b8 100644 --- a/it-and-security/lib/macos/policies/install-nudge-assets.yml +++ b/it-and-security/lib/macos/policies/install-nudge-assets.yml @@ -1,4 +1,4 @@ -- name: macOS - Nudge assets installed +- name: Nudge assets installed query: SELECT 1 WHERE EXISTS (SELECT 1 FROM package_receipts WHERE package_id = "com.fleetdm.Nudge.assets"); critical: true description: This policy ensures the Nudge assets are installed. diff --git a/it-and-security/lib/macos/policies/install-santa-extension.yml b/it-and-security/lib/macos/policies/install-santa-extension.yml index 562ba192c5..0bd0229582 100644 --- a/it-and-security/lib/macos/policies/install-santa-extension.yml +++ b/it-and-security/lib/macos/policies/install-santa-extension.yml @@ -1,4 +1,4 @@ -- name: macOS - Santa extension installed +- name: Santa extension installed query: SELECT 1 WHERE EXISTS (SELECT * FROM file_lines WHERE path = "/var/osquery/extensions.load" AND line = "/var/fleet/extensions/santa.ext"); critical: false description: This policy ensures the custom extension for santa is installed. diff --git a/it-and-security/lib/macos/policies/latest-macos.yml b/it-and-security/lib/macos/policies/latest-macos.yml index 42f7e8d574..1342abbfcc 100644 --- a/it-and-security/lib/macos/policies/latest-macos.yml +++ b/it-and-security/lib/macos/policies/latest-macos.yml @@ -1,4 +1,4 @@ -- name: macOS - Operating system up to date +- name: Operating system up to date query: SELECT 1 FROM os_version WHERE version >= '26.4.1' OR version >= '15.7.5'; critical: true description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability. diff --git a/it-and-security/lib/macos/policies/local-admin-count-reasonable.yml b/it-and-security/lib/macos/policies/local-admin-count-reasonable.yml index 86866a4c99..5ccf8d7618 100644 --- a/it-and-security/lib/macos/policies/local-admin-count-reasonable.yml +++ b/it-and-security/lib/macos/policies/local-admin-count-reasonable.yml @@ -1,4 +1,4 @@ -- name: macOS - Local admin accounts within limit +- name: Local admin accounts within limit query: |- SELECT 1 WHERE ( SELECT COUNT(DISTINCT u.uid) diff --git a/it-and-security/lib/macos/policies/nudge-installed.yml b/it-and-security/lib/macos/policies/nudge-installed.yml index eb373628ea..c7b3e541df 100644 --- a/it-and-security/lib/macos/policies/nudge-installed.yml +++ b/it-and-security/lib/macos/policies/nudge-installed.yml @@ -1,4 +1,4 @@ -- name: macOS - Nudge installed +- name: Nudge installed query: SELECT 1 FROM apps WHERE bundle_identifier = "com.github.macadmins.Nudge"; critical: true description: This policy ensures Nudge is installed. diff --git a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml index 62ea0aa8d8..92f34bfbfa 100644 --- a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml +++ b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml @@ -1,4 +1,4 @@ -- name: macOS - Google Chrome up to date +- name: Google Chrome up to date (macOS) description: The host may have an outdated version of Google Chrome, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Google Chrome's built-in update functionality." type: patch @@ -6,7 +6,7 @@ install_software: false labels_include_any: - Macs with Google Chrome installed -- name: macOS - 1Password up to date +- name: 1Password up to date (macOS) description: This device may have an outdated version of 1Password, potentially risking security vulnerabilities or compatibility issues. resolution: "1Password is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -14,7 +14,7 @@ install_software: true labels_include_any: - Macs with 1Password installed -- name: macOS - Brave Browser up to date +- name: Brave Browser up to date description: The host may have an outdated version of Brave Browser, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Brave Browser's built-in update functionality. You can also delete Brave Browser if you are no longer using it." type: patch @@ -22,7 +22,7 @@ install_software: false labels_include_any: - Macs with Brave Browser installed -- name: macOS - Docker Desktop up to date +- name: Docker Desktop up to date description: The host may have an outdated version of Docker Desktop, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Docker Desktop's built-in update functionality. You can also delete Docker Desktop if you are no longer using it." type: patch @@ -30,7 +30,7 @@ install_software: false labels_include_any: - Macs with Docker Desktop installed -- name: macOS - Firefox up to date +- name: Firefox up to date (macOS) description: The host may have an outdated version of Firefox, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service, otherwise the update will automatically install during an upcoming scheduled maintenance window. Check your calendar for details." type: patch @@ -39,7 +39,7 @@ calendar_events_enabled: true labels_include_any: - Macs with Firefox installed -- name: macOS - Visual Studio Code up to date +- name: Visual Studio Code up to date (macOS) description: The host may have an outdated version of Visual Studio Code, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Visual Studio Code's built-in update functionality. You can also delete Visual Studio Code if you are no longer using it." type: patch @@ -47,7 +47,7 @@ install_software: false labels_include_any: - Macs with Visual Studio Code installed -- name: macOS - Slack up to date +- name: Slack up to date (macOS) description: The host may have an outdated version of Slack, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Slack's built-in update functionality." type: patch @@ -55,7 +55,7 @@ install_software: false labels_include_any: - Macs with Slack installed -- name: macOS - Zoom up to date +- name: Zoom up to date (macOS) description: The host may have an outdated version of Zoom, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Zoom's built-in update functionality." type: patch @@ -63,7 +63,7 @@ install_software: false labels_include_any: - Macs with Zoom installed -- name: macOS - Okta Verify up to date +- name: Okta Verify up to date (macOS) description: The host may have an outdated version of Okta Verify, potentially risking security vulnerabilities or compatibility issues. resolution: "Okta Verify is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -71,7 +71,7 @@ install_software: true labels_include_any: - Macs with Okta Verify installed -- name: macOS - Santa up to date +- name: Santa up to date description: The host may have an outdated version of Santa, potentially risking security vulnerabilities or compatibility issues. resolution: "Santa is an app managed by IT and should be kept up to date automatically. If you are failing this policy, click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -79,7 +79,7 @@ install_software: true labels_include_any: - Macs with Santa installed -- name: macOS - Fleet Desktop up to date +- name: Fleet Desktop up to date description: The host may have an outdated version of Fleet Desktop, potentially risking security vulnerabilities or compatibility issues. resolution: "Fleet Desktop is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -87,7 +87,7 @@ install_software: true labels_include_any: - Macs with Fleet Desktop.app installed -- name: macOS - Claude up to date +- name: Claude up to date (macOS) description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Claude's built-in update functionality. You can also delete Claude if you are no longer using it." type: patch @@ -95,7 +95,7 @@ install_software: false labels_include_any: - Macs with Claude installed -- name: macOS - AWS VPN Client up to date +- name: AWS VPN Client up to date description: The host may have an outdated version of AWS VPN Client, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using AWS VPN Client's built-in update functionality. You can also delete AWS VPN Client if you are no longer using it." type: patch @@ -103,7 +103,7 @@ install_software: false labels_include_any: - Macs with AWS VPN Client installed -- name: macOS - GitHub Desktop up to date +- name: GitHub Desktop up to date description: The host may have an outdated version of GitHub Desktop, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using GitHub Desktop's built-in update functionality. You can also delete GitHub Desktop if you are no longer using it." type: patch @@ -111,7 +111,7 @@ install_software: false labels_include_any: - Macs with GitHub Desktop installed -- name: macOS - UTM up to date +- name: UTM up to date description: The host may have an outdated version of UTM, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using UTM's built-in update functionality. You can also delete UTM if you are no longer using it." type: patch @@ -119,7 +119,7 @@ install_software: false labels_include_any: - Macs with UTM installed -- name: macOS - Postman up to date +- name: Postman up to date description: The host may have an outdated version of Postman, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Postman's built-in update functionality. You can also delete Postman if you are no longer using it." type: patch @@ -127,7 +127,7 @@ install_software: false labels_include_any: - Macs with Postman installed -- name: macOS - Grammarly Desktop up to date +- name: Grammarly Desktop up to date description: The host may have an outdated version of Grammarly Desktop, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Grammarly Desktop's built-in update functionality. You can also delete Grammarly Desktop if you are no longer using it." type: patch @@ -135,7 +135,7 @@ install_software: false labels_include_any: - Macs with Grammarly Desktop installed -- name: macOS - iTerm2 up to date +- name: iTerm2 up to date description: The host may have an outdated version of iTerm2, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using iTerm2's built-in update functionality. You can also delete iTerm2 if you are no longer using it." type: patch @@ -143,7 +143,7 @@ install_software: false labels_include_any: - Macs with iTerm2 installed -- name: macOS - Sublime Text up to date +- name: Sublime Text up to date description: The host may have an outdated version of Sublime Text, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Sublime Text's built-in update functionality. You can also delete Sublime Text if you are no longer using it." type: patch @@ -151,7 +151,7 @@ install_software: false labels_include_any: - Macs with Sublime Text installed -- name: macOS - Parallels Desktop up to date +- name: Parallels Desktop up to date description: The host may have an outdated version of Parallels Desktop, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Parallels Desktop's built-in update functionality. You can also delete Parallels Desktop if you are no longer using it." type: patch @@ -159,7 +159,7 @@ install_software: false labels_include_any: - Macs with Parallels Desktop installed -- name: macOS - Loom up to date +- name: Loom up to date description: The host may have an outdated version of Loom, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Loom's built-in update functionality. You can also delete Loom if you are no longer using it." type: patch @@ -167,7 +167,7 @@ install_software: false labels_include_any: - Macs with Loom installed -- name: macOS - Spotify up to date +- name: Spotify up to date description: The host may have an outdated version of Spotify, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Spotify's built-in update functionality. You can also delete Spotify if you are no longer using it." type: patch @@ -175,7 +175,7 @@ install_software: false labels_include_any: - Macs with Spotify installed -- name: macOS - Rectangle up to date +- name: Rectangle up to date description: The host may have an outdated version of Rectangle, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Rectangle's built-in update functionality. You can also delete Rectangle if you are no longer using it." type: patch @@ -183,7 +183,7 @@ install_software: false labels_include_any: - Macs with Rectangle installed -- name: macOS - Logi Options+ up to date +- name: Logi Options+ up to date description: The host may have an outdated version of Logi Options+, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Logi Options+'s built-in update functionality. You can also delete Logi Options+ if you are no longer using it." type: patch @@ -191,7 +191,7 @@ install_software: false labels_include_any: - Macs with Logi Options+ installed -- name: macOS - Figma up to date +- name: Figma up to date description: The host may have an outdated version of Figma, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Figma's built-in update functionality. You can also delete Figma if you are no longer using it." type: patch @@ -199,7 +199,7 @@ install_software: false labels_include_any: - Macs with Figma installed -- name: macOS - WhatsApp up to date +- name: WhatsApp up to date description: The host may have an outdated version of WhatsApp, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using WhatsApp's built-in update functionality. You can also delete WhatsApp if you are no longer using it." type: patch @@ -207,7 +207,7 @@ install_software: false labels_include_any: - Macs with WhatsApp installed -- name: macOS - Android Studio up to date +- name: Android Studio up to date description: The host may have an outdated version of Android Studio, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Android Studio's built-in update functionality. You can also delete Android Studio if you are no longer using it." type: patch @@ -215,7 +215,7 @@ install_software: false labels_include_any: - Macs with Android Studio installed -- name: macOS - Zed up to date +- name: Zed up to date description: The host may have an outdated version of Zed, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Zed's built-in update functionality. You can also delete Zed if you are no longer using it." type: patch @@ -223,7 +223,7 @@ install_software: false labels_include_any: - Macs with Zed installed -- name: macOS - Obsidian up to date +- name: Obsidian up to date description: The host may have an outdated version of Obsidian, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Obsidian's built-in update functionality. You can also delete Obsidian if you are no longer using it." type: patch @@ -231,7 +231,7 @@ install_software: false labels_include_any: - Macs with Obsidian installed -- name: macOS - Google Drive up to date +- name: Google Drive up to date description: The host may have an outdated version of Google Drive, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Google Drive's built-in update functionality. You can also delete Google Drive if you are no longer using it." type: patch @@ -239,7 +239,7 @@ install_software: false labels_include_any: - Macs with Google Drive installed -- name: macOS - Cursor up to date +- name: Cursor up to date description: The host may have an outdated version of Cursor, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Cursor's built-in update functionality. You can also delete Cursor if you are no longer using it." type: patch @@ -247,7 +247,7 @@ install_software: false labels_include_any: - Macs with Cursor installed -- name: macOS - Nudge up to date +- name: Nudge up to date description: The host may have an outdated version of Nudge, potentially risking security vulnerabilities or compatibility issues. resolution: "Nudge is an app managed by IT and should be kept up to date automatically. If you are failing this policy, click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -255,7 +255,7 @@ install_software: true labels_include_any: - Macs with Nudge installed -- name: macOS - Adobe Acrobat Reader up to date +- name: Adobe Acrobat Reader up to date (macOS) description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times. resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." critical: true @@ -264,7 +264,7 @@ install_software: true labels_include_any: - Macs with Adobe Acrobat Reader installed -- name: macOS - Adobe Acrobat Pro up to date +- name: Adobe Acrobat Pro up to date description: This device may have an outdated version of Adobe Acrobat Pro, posing a critical security risk. Adobe Acrobat is a frequent target for exploits and must be kept up to date at all times. resolution: "Adobe Acrobat Pro is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." critical: true diff --git a/it-and-security/lib/macos/policies/remote-login-disabled.yml b/it-and-security/lib/macos/policies/remote-login-disabled.yml index 190bfd3caf..4e5a4789d8 100644 --- a/it-and-security/lib/macos/policies/remote-login-disabled.yml +++ b/it-and-security/lib/macos/policies/remote-login-disabled.yml @@ -1,4 +1,4 @@ -- name: macOS - Remote Login (SSH) disabled +- name: Remote Login (SSH) disabled query: SELECT 1 FROM sharing_preferences WHERE CAST(remote_login AS INTEGER) = 0; critical: false description: |- diff --git a/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml b/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml index 5d47516967..b43b5f7e9e 100644 --- a/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml +++ b/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml @@ -1,4 +1,4 @@ -- name: macOS - Santa Endpoint Security extension active +- name: Santa Endpoint Security extension active platform: darwin description: Santa is installed but its Endpoint Security system extension is missing or not in the activated enabled state. resolution: "Fleet can run the remediation script to request extension activation. If it still fails, please reach out to help-it in Slack." diff --git a/it-and-security/lib/macos/policies/screen-lock-inactivity.yml b/it-and-security/lib/macos/policies/screen-lock-inactivity.yml index 207a74ca50..24e35719f8 100644 --- a/it-and-security/lib/macos/policies/screen-lock-inactivity.yml +++ b/it-and-security/lib/macos/policies/screen-lock-inactivity.yml @@ -1,4 +1,4 @@ -- name: macOS - Screen lock after inactivity (15 minutes or less) +- name: Screen lock after inactivity (15 minutes or less) query: |- SELECT 1 WHERE EXISTS ( SELECT 1 diff --git a/it-and-security/lib/macos/policies/sip-enabled.yml b/it-and-security/lib/macos/policies/sip-enabled.yml index 9cff518a36..8f995e6a6f 100644 --- a/it-and-security/lib/macos/policies/sip-enabled.yml +++ b/it-and-security/lib/macos/policies/sip-enabled.yml @@ -1,4 +1,4 @@ -- name: macOS - System Integrity Protection enabled +- name: System Integrity Protection enabled query: SELECT 1 FROM sip_config WHERE config_flag = 'sip' AND enabled = 1; critical: true description: |- diff --git a/it-and-security/lib/macos/policies/update-claude.yml b/it-and-security/lib/macos/policies/update-claude.yml index 353cac5afb..7cecba4cc7 100644 --- a/it-and-security/lib/macos/policies/update-claude.yml +++ b/it-and-security/lib/macos/policies/update-claude.yml @@ -1,4 +1,4 @@ -- name: macOS - Claude up to date +- name: Claude up to date (macOS) query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.anthropic.claudefordesktop' AND version_compare(bundle_short_version, '1.1.9493') < 0); critical: false description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues. diff --git a/it-and-security/lib/macos/policies/update-safari.yml b/it-and-security/lib/macos/policies/update-safari.yml index ccfa16e484..08209abfca 100644 --- a/it-and-security/lib/macos/policies/update-safari.yml +++ b/it-and-security/lib/macos/policies/update-safari.yml @@ -1,4 +1,4 @@ -- name: macOS - Safari up to date +- name: Safari up to date query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari') OR (EXISTS (SELECT 1 FROM os_version WHERE version LIKE '26.%') AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '26.4') >= 0)) OR (EXISTS (SELECT 1 FROM os_version WHERE version LIKE '15.%') AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '18.6') >= 0)); critical: false description: The host may have an outdated version of Safari, potentially risking security vulnerabilities or compatibility issues. diff --git a/it-and-security/lib/macos/policies/update-slack.yml b/it-and-security/lib/macos/policies/update-slack.yml index 6adc1f3b10..ce2cc0e031 100644 --- a/it-and-security/lib/macos/policies/update-slack.yml +++ b/it-and-security/lib/macos/policies/update-slack.yml @@ -1,4 +1,4 @@ -- name: macOS - Slack up to date +- name: Slack up to date (macOS) query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.48.100') < 0); critical: false description: The host may have an outdated version of Slack, potentially risking security vulnerabilities or compatibility issues. diff --git a/it-and-security/lib/windows/policies/1password-installed.yml b/it-and-security/lib/windows/policies/1password-installed.yml index 6c1a519840..ff200f160a 100644 --- a/it-and-security/lib/windows/policies/1password-installed.yml +++ b/it-and-security/lib/windows/policies/1password-installed.yml @@ -1,4 +1,4 @@ -- name: Windows - 1Password installed +- name: 1Password installed (Windows) query: SELECT 1 FROM programs WHERE name = "1Password"; # install_software: # fleet_maintained_app_slug: 1password/windows diff --git a/it-and-security/lib/windows/policies/all-windows-updates-installed.yml b/it-and-security/lib/windows/policies/all-windows-updates-installed.yml index bb48c5b8c3..0d2cc28cf4 100644 --- a/it-and-security/lib/windows/policies/all-windows-updates-installed.yml +++ b/it-and-security/lib/windows/policies/all-windows-updates-installed.yml @@ -1,4 +1,4 @@ -- name: Windows - All available updates installed +- name: All available updates installed query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM windows_updates); critical: false description: This Windows device may have outdated system software, which could lead to security vulnerabilities, performance issues, and incompatibility with other systems. diff --git a/it-and-security/lib/windows/policies/antivirus-signatures-up-to-date.yml b/it-and-security/lib/windows/policies/antivirus-signatures-up-to-date.yml index 5c2d80ad0c..fc38bd8d4f 100644 --- a/it-and-security/lib/windows/policies/antivirus-signatures-up-to-date.yml +++ b/it-and-security/lib/windows/policies/antivirus-signatures-up-to-date.yml @@ -1,4 +1,4 @@ -- name: Windows - Antivirus signatures up to date +- name: Antivirus signatures up to date query: SELECT 1 FROM windows_security_products WHERE name LIKE '%Microsoft Defender Antivirus%' AND signatures_up_to_date = 1; critical: false description: Checks the status of antivirus and signature updates from the Windows Security Center. diff --git a/it-and-security/lib/windows/policies/battery-health-check.yml b/it-and-security/lib/windows/policies/battery-health-check.yml index 0fa766b3d0..ac3042b2df 100644 --- a/it-and-security/lib/windows/policies/battery-health-check.yml +++ b/it-and-security/lib/windows/policies/battery-health-check.yml @@ -1,4 +1,4 @@ -- name: Windows - Battery healthy +- name: Battery healthy (Windows) query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM battery WHERE designed_capacity > 0 AND CAST(max_capacity AS REAL) / designed_capacity <= 0.80); critical: false description: >- diff --git a/it-and-security/lib/windows/policies/disk-encryption-check.yml b/it-and-security/lib/windows/policies/disk-encryption-check.yml index ca03a54fab..f40ea12917 100644 --- a/it-and-security/lib/windows/policies/disk-encryption-check.yml +++ b/it-and-security/lib/windows/policies/disk-encryption-check.yml @@ -1,4 +1,4 @@ -- name: Windows - Disk encryption enabled +- name: Disk encryption enabled (Windows) query: SELECT 1 FROM bitlocker_info WHERE protection_status = 1; critical: false description: This policy checks if disk encryption is enabled. diff --git a/it-and-security/lib/windows/policies/disk-space-check.yml b/it-and-security/lib/windows/policies/disk-space-check.yml index 1c09ee92c3..cbe860cc47 100644 --- a/it-and-security/lib/windows/policies/disk-space-check.yml +++ b/it-and-security/lib/windows/policies/disk-space-check.yml @@ -1,4 +1,4 @@ -- name: Windows - Sufficient disk space available +- name: Sufficient disk space available (Windows) query: SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) / SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10; critical: false description: >- diff --git a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml index b49160ae36..f2dafe197d 100644 --- a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml +++ b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml @@ -1,4 +1,4 @@ -- name: Windows - Slack up to date +- name: Slack up to date (Windows) description: The host may have an outdated version of Slack, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Slack's built-in update functionality." type: patch @@ -6,7 +6,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Slack installed -- name: Windows - 1Password up to date +- name: 1Password up to date (Windows) description: This device may have an outdated version of 1Password, potentially risking security vulnerabilities or compatibility issues. resolution: "1Password is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -14,7 +14,7 @@ install_software: true labels_include_any: - x86 Windows hosts with 1Password installed -- name: Windows - Claude up to date +- name: Claude up to date (Windows) description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Claude's built-in update functionality. You can also uninstall Claude if you are no longer using it." type: patch @@ -22,7 +22,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Claude installed -- name: Windows - Firefox up to date +- name: Firefox up to date (Windows) description: The host may have an outdated version of Firefox, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Firefox's built-in update functionality. You can also uninstall Firefox if you are no longer using it." type: patch @@ -30,7 +30,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Firefox installed -- name: Windows - Google Chrome up to date +- name: Google Chrome up to date (Windows) description: The host may have an outdated version of Google Chrome, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Google Chrome's built-in update functionality." type: patch @@ -38,7 +38,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Google Chrome installed -- name: Windows - Zoom up to date +- name: Zoom up to date (Windows) description: The host may have an outdated version of Zoom, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Zoom's built-in update functionality." type: patch @@ -46,7 +46,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Zoom installed -- name: Windows - Visual Studio Code up to date +- name: Visual Studio Code up to date (Windows) description: The host may have an outdated version of Visual Studio Code, potentially risking security vulnerabilities or compatibility issues. resolution: "Download the latest version from Self-service or check for updates using Visual Studio Code's built-in update functionality. You can also uninstall Visual Studio Code if you are no longer using it." type: patch @@ -54,7 +54,7 @@ install_software: false labels_include_any: - x86 Windows hosts with Visual Studio Code installed -- name: Windows - Okta Verify up to date +- name: Okta Verify up to date (Windows) description: The host may have an outdated version of Okta Verify, potentially risking security vulnerabilities or compatibility issues. resolution: "Okta Verify is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." type: patch @@ -62,7 +62,7 @@ install_software: true labels_include_any: - x86 Windows hosts with Okta Verify installed -- name: Windows - Adobe Acrobat Reader up to date +- name: Adobe Acrobat Reader up to date (Windows) description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times. resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." critical: true diff --git a/it-and-security/lib/windows/policies/remote-desktop-disabled.yml b/it-and-security/lib/windows/policies/remote-desktop-disabled.yml index e8cb4aea96..6ab87f775b 100644 --- a/it-and-security/lib/windows/policies/remote-desktop-disabled.yml +++ b/it-and-security/lib/windows/policies/remote-desktop-disabled.yml @@ -1,4 +1,4 @@ -- name: Windows - Remote Desktop disabled +- name: Remote Desktop disabled query: |- SELECT 1 FROM registry WHERE key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server' diff --git a/it-and-security/lib/windows/policies/screen-lock-timeout-configured.yml b/it-and-security/lib/windows/policies/screen-lock-timeout-configured.yml index c6fc95efe1..2c2efb7703 100644 --- a/it-and-security/lib/windows/policies/screen-lock-timeout-configured.yml +++ b/it-and-security/lib/windows/policies/screen-lock-timeout-configured.yml @@ -1,4 +1,4 @@ -- name: Windows - Interactive logon screen lock timeout configured +- name: Interactive logon screen lock timeout configured query: |- SELECT 1 FROM registry WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' diff --git a/it-and-security/lib/windows/policies/secure-boot-enabled.yml b/it-and-security/lib/windows/policies/secure-boot-enabled.yml index 315ab364e7..f1143d0edb 100644 --- a/it-and-security/lib/windows/policies/secure-boot-enabled.yml +++ b/it-and-security/lib/windows/policies/secure-boot-enabled.yml @@ -1,4 +1,4 @@ -- name: Windows - Secure Boot enabled +- name: Secure Boot enabled query: |- SELECT 1 FROM registry WHERE key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State' diff --git a/it-and-security/lib/windows/policies/update-claude.yml b/it-and-security/lib/windows/policies/update-claude.yml index 63973e1b29..13c7d9ddaf 100644 --- a/it-and-security/lib/windows/policies/update-claude.yml +++ b/it-and-security/lib/windows/policies/update-claude.yml @@ -1,4 +1,4 @@ -- name: Windows - Claude up to date +- name: Claude up to date (Windows) query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Claude' AND version_compare(version, '1.1.9310') < 0); critical: false description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues. diff --git a/it-and-security/lib/windows/policies/update-slack.yml b/it-and-security/lib/windows/policies/update-slack.yml index e70a13beef..01e3c62a40 100644 --- a/it-and-security/lib/windows/policies/update-slack.yml +++ b/it-and-security/lib/windows/policies/update-slack.yml @@ -1,4 +1,4 @@ -- name: Windows - Slack up to date +- name: Slack up to date (Windows) query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'Slack' AND version_compare(version, '4.48.100') < 0); critical: false description: The host may have an outdated version of Slack, potentially risking security vulnerabilities or compatibility issues. diff --git a/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml index 8798a83c28..52ac2704e0 100644 --- a/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml +++ b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml @@ -1,4 +1,4 @@ -- name: Windows - Windows Defender compliance check +- name: Windows Defender compliance check query: | WITH defender_service AS ( SELECT