From dbe7f4bd3f279f1ceb965ca593855a0ac2b31596 Mon Sep 17 00:00:00 2001
From: kitzy <kitzy@fleetdm.com>
Date: Tue, 16 Jun 2026 17:24:27 -0400
Subject: [PATCH] Add query to list users with secure token for FileVault
 access on macOS (#47466)

Introduce a query that lists local user accounts with a secure token,
which is necessary for FileVault access on macOS. This enhancement
provides visibility into user accounts that meet the criteria.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a new inventory query for macOS users to identify those with
secure token protection enabled.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 docs/queries.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/docs/queries.yml b/docs/queries.yml
index c303c22504..9e30726937 100644
--- a/docs/queries.yml
+++ b/docs/queries.yml
@@ -5022,3 +5022,21 @@ spec:
   purpose: Detection
   tags: MITRE, ATT&CK, threat detection
   contributors: teoseller,tux234
+---
+apiVersion: v1
+kind: query
+spec:
+  name: Get users with secure token
+  platform: darwin
+  description: Lists local user accounts (UID 501 and above) and indicates whether each has a secure token, which is required for FileVault access on macOS.
+  query: |-
+    SELECT
+      u.uid,
+      u.username,
+      CASE WHEN fu.uuid IS NOT NULL THEN 1 ELSE 0 END AS has_secure_token
+    FROM users u
+    LEFT JOIN filevault_users fu ON fu.uuid = u.uuid
+    WHERE u.uid >= 501;
+  purpose: Informational
+  tags: filevault, users
+  contributors: kitzy,jakestenger