From f85dc597c1b4d4bbf08440dcfaa93f28ed4e4c2a Mon Sep 17 00:00:00 2001
From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Date: Wed, 29 Jan 2025 12:46:41 -0600
Subject: [PATCH] Cleaning up policies (#25850)

In support of this issue: fleetdm/confidential#8791
---
 .../collect-operating-system-information.yaml |   8 ++
 ...e-health.yml => disk-encryption-check.yml} |   4 +-
 .../1password-emergency-kit-check.yml         |  12 ++
 it-and-security/lib/macos/policies/cis.yml    | 105 ------------------
 .../lib/macos/policies/device-health.yml      |  67 -----------
 .../lib/macos/policies/update-firefox.yml     |   2 +-
 .../lib/macos/policies/update-slack.yml       |   2 +-
 it-and-security/lib/windows/policies/cis.yml  |  58 ----------
 .../lib/windows/policies/device-health.yml    |  31 ------
 .../policies/windows-device-health.yml        |   7 ++
 it-and-security/teams/workstations-canary.yml |   6 +-
 it-and-security/teams/workstations.yml        |   8 +-
 12 files changed, 37 insertions(+), 273 deletions(-)
 create mode 100644 it-and-security/lib/all/queries/collect-operating-system-information.yaml
 rename it-and-security/lib/linux/policies/{linux-device-health.yml => disk-encryption-check.yml} (51%)
 create mode 100644 it-and-security/lib/macos/policies/1password-emergency-kit-check.yml
 delete mode 100644 it-and-security/lib/macos/policies/cis.yml
 delete mode 100644 it-and-security/lib/macos/policies/device-health.yml
 delete mode 100644 it-and-security/lib/windows/policies/cis.yml
 delete mode 100644 it-and-security/lib/windows/policies/device-health.yml
 create mode 100644 it-and-security/lib/windows/policies/windows-device-health.yml

diff --git a/it-and-security/lib/all/queries/collect-operating-system-information.yaml b/it-and-security/lib/all/queries/collect-operating-system-information.yaml
new file mode 100644
index 0000000000..b5dc9a72b3
--- /dev/null
+++ b/it-and-security/lib/all/queries/collect-operating-system-information.yaml
@@ -0,0 +1,8 @@
+- name: Collect operating system information
+  description: "Collects operating system information from all devices enrolled in Fleet"
+  query: SELECT * FROM os_version;
+  interval: 3600 # Every 1 hour
+  observer_can_run: true
+  automations_enabled: true
+  logging: snapshot
+  platform: darwin,linux,windows,chrome
diff --git a/it-and-security/lib/linux/policies/linux-device-health.yml b/it-and-security/lib/linux/policies/disk-encryption-check.yml
similarity index 51%
rename from it-and-security/lib/linux/policies/linux-device-health.yml
rename to it-and-security/lib/linux/policies/disk-encryption-check.yml
index b7093c02ac..acf738be6f 100644
--- a/it-and-security/lib/linux/policies/linux-device-health.yml
+++ b/it-and-security/lib/linux/policies/disk-encryption-check.yml
@@ -1,6 +1,6 @@
-- name: Linux - Enable disk encryption
+- name: Linux - Disk encryption enabled
   query: SELECT 1 FROM mounts m, disk_encryption d WHERE m.device_alias = d.name AND d.encrypted = 1 AND m.path = '/';
   critical: false
   description: This policy checks if disk encryption is enabled.
-  resolution: As an IT admin, deploy an image that includes disk encryption.
+  resolution: Disk encryption can only be configured during initial operating system install. Please re-install your operating system ensuring disk encryption is enabled.
   platform: linux
diff --git a/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml b/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml
new file mode 100644
index 0000000000..0264443cc6
--- /dev/null
+++ b/it-and-security/lib/macos/policies/1password-emergency-kit-check.yml
@@ -0,0 +1,12 @@
+- name: macOS - No 1Password emergency kit stored in desktop, documents, or downloads folders
+  query: SELECT 1 WHERE 
+    NOT EXISTS (
+      SELECT 1 FROM file WHERE 
+        filename LIKE '%Emergency Kit%.pdf' AND 
+        (path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%')
+    );
+  critical: false
+  description: Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.
+  resolution: Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.
+  platform: darwin
+  
\ No newline at end of file
diff --git a/it-and-security/lib/macos/policies/cis.yml b/it-and-security/lib/macos/policies/cis.yml
deleted file mode 100644
index 71cd37efb8..0000000000
--- a/it-and-security/lib/macos/policies/cis.yml
+++ /dev/null
@@ -1,105 +0,0 @@
-- name: CIS - Ensure Auto Update Is Enabled (MDM Required)
-  critical: false
-  platform: darwin
-  description: Checks that the system is configured via MDM to automatically install updates.
-  resolution: "Ask your system administrator to deploy an MDM profile that enables automatic updates."
-  query: |
-    SELECT 1 WHERE 
-      EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticCheckEnabled' AND 
-            (value = 1 OR value = 'true') AND 
-            username = ''
-        )
-      AND NOT EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticCheckEnabled' AND 
-            (value != 1 AND value != 'true')
-        );  
-- name: CIS - Ensure Download New Updates When Available Is Enabled (MDM Required)
-  critical: false
-  platform: darwin
-  description: Checks that the system is configured via MDM to automatically download updates.
-  resolution: "Ask your system administrator to deploy an MDM profile that enables automatic update downloads."
-  query: |
-    SELECT 1 WHERE 
-      EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticDownload' AND 
-            (value = 1 OR value = 'true') AND 
-            username = ''
-        )
-      AND NOT EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticDownload' AND 
-            (value != 1 AND value != 'true')
-        );  
-- name: CIS - Ensure Install of macOS Updates Is Enabled (MDM Required)
-  critical: false
-  platform: darwin
-  description: Ensure that macOS updates are installed after they are available from Apple.
-  resolution: "Ask your system administrator to deploy an MDM profile that enables automatic install of macOS updates."
-  query: |
-    SELECT 1 WHERE 
-      EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticallyInstallMacOSUpdates' AND 
-            (value = 1 OR value = 'true') AND 
-            username = ''
-        )
-      AND NOT EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticallyInstallMacOSUpdates' AND 
-            (value != 1 AND value != 'true')
-        );  
-- name: CIS - Ensure Install Application Updates from the App Store Is Enabled (MDM Required)
-  critical: false
-  platform: darwin
-  description: Ensure that application updates are installed after they are available from Apple.
-  resolution: Ask your system administrator to deploy an MDM profile that enables automatic updates of Apple apps.
-  query: |
-    SELECT 1 WHERE 
-      EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticallyInstallAppUpdates' AND 
-            (value = 1 OR value = 'true') AND 
-            username = ''
-        )
-      AND NOT EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='AutomaticallyInstallAppUpdates' AND 
-            (value != 1 AND value != 'true')
-        );  
-
-- name: CIS - Ensure Install Security Responses and System Files Is Enabled (MDM Required)
-  critical: false
-  platform: darwin
-  description: |
-    Ensure that system and security updates are installed after they are available from
-    Apple. This setting enables definition updates for XProtect and Gatekeeper. With this
-    setting in place, new malware and adware that Apple has added to the list of malware or
-    untrusted software will not execute.
-  resolution: "Ask your system administrator to deploy an MDM profile that enables automatic critical system and security updates."
-  query: |
-    SELECT 1 WHERE 
-      EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='CriticalUpdateInstall' AND 
-            (value = 1 OR value = 'true') AND 
-            username = ''
-        )
-      AND NOT EXISTS (
-        SELECT 1 FROM managed_policies WHERE 
-            domain='com.apple.SoftwareUpdate' AND 
-            name='CriticalUpdateInstall' AND 
-            (value != 1 AND value != 'true')
-        );  
diff --git a/it-and-security/lib/macos/policies/device-health.yml b/it-and-security/lib/macos/policies/device-health.yml
deleted file mode 100644
index 75bfaf4b0b..0000000000
--- a/it-and-security/lib/macos/policies/device-health.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-- name: macOS - Enable FileVault
-  query: SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.';
-  critical: false
-  description: This policy checks if FileVault (disk encryption) is enabled.
-  resolution: As an IT admin, turn on disk encryption in Fleet.
-  platform: darwin
-- name: macOS - Enable Firewall
-  query: SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND username = '' AND name='EnableFirewall' AND CAST(value AS INT) = 1;
-  critical: false
-  description: This policy checks if Firewall is enabled.
-  resolution: An an IT admin, deploy a macOS, Firewall profile with the EnableFirewall option set to true.
-  platform: darwin
-- name: macOS - Disable guest account
-  query: SELECT 1 FROM plist WHERE path='/Library/Preferences/com.apple.loginwindow.plist' AND key='GuestEnabled' AND value = 0;
-  critical: false
-  description: This policy checks if the guest account is disabled.
-  resolution: An an IT admin, deploy a macOS, login window profile with the DisableGuestAccount option set to true.
-  platform: darwin
-- name: macOS - Require 10 character password
-  query: SELECT 1 WHERE 
-    EXISTS (
-      SELECT 1 FROM managed_policies WHERE 
-        domain='com.apple.screensaver' AND 
-        name='askForPassword' AND 
-        CAST(value AS INT)
-    ) 
-    AND EXISTS (
-      SELECT 1 FROM managed_policies WHERE 
-        domain='com.apple.screensaver' AND 
-        name='minLength' AND 
-        CAST(value AS INT) <= 10
-    );
-  critical: false
-  description: This policy checks if the end user is required to enter a password, with at least 10 characters, to unlock the host.
-  resolution: An an IT admin, deploy a macOS, screensaver profile with the askForPassword option set to true and minLength option set to 10.
-  platform: darwin
-- name: macOS - Enable screen saver after 20 minutes
-  query: SELECT 1 WHERE 
-    EXISTS (
-      SELECT 1 FROM managed_policies WHERE 
-        domain='com.apple.screensaver' AND 
-        name='idleTime' AND 
-        CAST(value AS INT) <= 1200 AND 
-        username = ''
-    ) 
-    AND NOT EXISTS (
-      SELECT 1 FROM managed_policies WHERE 
-        domain='com.apple.screensaver' AND 
-        name='idleTime' AND 
-        CAST(value AS INT) > 1200
-    );
-  critical: false
-  description: This policy checks if maximum amount of time (in minutes) the device is allowed to sit idle before the screen is locked. End users can select any value less than the specified maximum.
-  resolution: An an IT admin, deploy a macOS, screen saver profile with the maxInactivity option set to 20 minutes.
-  platform: darwin
-- name: macOS - No 1Password emergency kit stored in desktop, documents, or downloads folders
-  query: SELECT 1 WHERE 
-    NOT EXISTS (
-      SELECT 1 FROM file WHERE 
-        filename LIKE '%Emergency Kit%.pdf' AND 
-        (path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%')
-    );
-  critical: false
-  description: Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.
-  resolution: Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.
-  platform: darwin
-  
\ No newline at end of file
diff --git a/it-and-security/lib/macos/policies/update-firefox.yml b/it-and-security/lib/macos/policies/update-firefox.yml
index fbad4df869..d1c38c73cd 100644
--- a/it-and-security/lib/macos/policies/update-firefox.yml
+++ b/it-and-security/lib/macos/policies/update-firefox.yml
@@ -1,4 +1,4 @@
-- name: macOS - Update Firefox
+- name: macOS - Firefox up to date
   query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE name = 'Firefox.app') OR EXISTS (SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '134.0.2') >= 0);
   critical: false
   description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues.
diff --git a/it-and-security/lib/macos/policies/update-slack.yml b/it-and-security/lib/macos/policies/update-slack.yml
index 06b3d519a7..affa845cd7 100644
--- a/it-and-security/lib/macos/policies/update-slack.yml
+++ b/it-and-security/lib/macos/policies/update-slack.yml
@@ -1,4 +1,4 @@
-- name: macOS - Update Slack
+- name: macOS - Slack up to date
   query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE name = 'Slack.app') OR EXISTS (SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.42.116') >= 0);
   critical: false
   description: The host may be running an outdated version of Slack, which could pose security vulnerabilities or compatibility issues.
diff --git a/it-and-security/lib/windows/policies/cis.yml b/it-and-security/lib/windows/policies/cis.yml
deleted file mode 100644
index acb8ec3f13..0000000000
--- a/it-and-security/lib/windows/policies/cis.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-- name: CIS - Ensure 'Enforce password history' is set to '24' or more passwords
-  critical: false
-  platform: windows
-  description: |
-    This policy check determines the number of renewed, unique passwords that have to be associated with a user account before you can reuse an old password.
-  resolution: |
-    Automatic method:
-    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 24 or more passwords:
-    'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Enforce password history'
-  query: |
-    SELECT 1 FROM security_profile_info WHERE password_history_size >= 24;
-- name: CIS - Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'
-  critical: false
-  platform: windows
-  description: |
-    This policy setting defines how long a user can use their password before it expires.
-  resolution: |
-    Automatic method:
-    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 365 or fewer days, but not 0:
-    'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Maximum password age'
-  query: |
-    SELECT 1 FROM security_profile_info WHERE (maximum_password_age <= 365 AND maximum_password_age != 0);
-- name: CIS - Ensure 'Minimum password age' is set to '1 or more days'
-  critical: false
-  platform: windows
-  description: |
-    This policy setting determines the number of days that you must use a password before you can
-    change it. The range of values for this policy setting is between 1 and 999 days.
-  resolution: |
-    Automatic method:
-    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 1 or more days:
-    'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password age'
-  query: |
-    SELECT 1 FROM security_profile_info WHERE minimum_password_age >= 1;
-- name: CIS - Ensure 'Minimum password length' is set to '14 or more characters'
-  critical: false
-  platform: windows
-  description: |
-    This policy setting determines the least number of characters that make up a password for a user account.
-  resolution: |
-    Automatic method:
-    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 14 or more characters
-    'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password length'
-  query: |
-    SELECT 1 FROM security_profile_info WHERE minimum_password_length >= 14;
-- name: CIS - Ensure 'Password must meet complexity requirements' is set to 'Enabled'
-  critical: false
-  platform: windows
-  description: |
-    This policy setting checks all new passwords to ensure that they meet basic requirements for
-    strong passwords. Passwords that contain only alphanumeric characters are extremely easy to
-    discover with several publicly available tools.
-  resolution: |
-    Automatic method:
-    Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 'Enabled':
-    'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements'
-  query: |
-    SELECT 1 FROM security_profile_info WHERE password_complexity = 1;
diff --git a/it-and-security/lib/windows/policies/device-health.yml b/it-and-security/lib/windows/policies/device-health.yml
deleted file mode 100644
index 2d38928dd5..0000000000
--- a/it-and-security/lib/windows/policies/device-health.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-- name: Windows - Enable screen saver after 20 minutes
-  query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/MaxInactivityTimeDeviceLock</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) <= 20;
-  critical: false
-  description: This policy checks if maximum amount of time (in minutes) the device is allowed to sit idle before the screen is locked. End users can select any value less than the specified maximum.
-  resolution: "As an IT admin, to deploy a Windows profile with the MaxInactivityTimeDeviceLock option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock#maxinactivitytimedevicelock"
-  platform: windows
-- name: Windows - Enable BitLocker
-  query: SELECT * FROM bitlocker_info WHERE drive_letter='C:' AND protection_status = 1;
-  critical: false
-  description: As an IT admin, turn on disk encryption in Fleet.
-  resolution: Ask your system administrator to turn on disk encryption in Fleet
-  platform: windows
-- name: Windows - Disable guest account
-  query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
-  critical: false
-  description: This policy checks if the guest account is disabled. The Guest account allows unauthenticated network users to gain access to the system.
-  resolution: "As an IT admin, deploy a Windows profile with the Accounts_EnableGuestAccountStatus option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#accounts_enableguestaccountstatus"
-  platform: windows
-- name: Windows - Require 10 character password
-  query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/DevicePasswordEnabled</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
-  critical: false
-  description: This policy checks if the end user is required to enter a password, with at least 10 characters, to unlock the host.
-  resolution: "As an IT admin, deploy a Windows profile with the DevicePasswordEnabled and MinDevicePasswordLength option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock"
-  platform: windows
-- name: Windows - Antivirus healthy
-  query: SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;
-  critical: false
-  description: Checks the status of antivirus and signature updates from the Windows Security Center.
-  resolution: "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center."
-  platform: windows
-  
\ No newline at end of file
diff --git a/it-and-security/lib/windows/policies/windows-device-health.yml b/it-and-security/lib/windows/policies/windows-device-health.yml
new file mode 100644
index 0000000000..89f2bc7972
--- /dev/null
+++ b/it-and-security/lib/windows/policies/windows-device-health.yml
@@ -0,0 +1,7 @@
+- name: Windows - Antivirus signatures up to date
+  query: SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;
+  critical: false
+  description: Checks the status of antivirus and signature updates from the Windows Security Center.
+  resolution: "Run all available Windows updates."
+  platform: windows
+  
\ No newline at end of file
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 0f0661a198..84792d49d0 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -122,12 +122,12 @@ controls:
     - path: ../lib/windows/scripts/install-bitdefender.ps1
     - path: ../lib/windows/scripts/enable-ms-defender.ps1
 policies:
-  - path: ../lib/macos/policies/device-health.yml
+  - path: ../lib/macos/policies/1password-emergency-kit-check.yml
   - path: ../lib/macos/policies/update-firefox.yml
   - path: ../lib/macos/policies/update-slack.yml
   - path: ../lib/macos/policies/latest-macos.yml
-  - path: ../lib/windows/policies/device-health.yml
-  - path: ../lib/linux/policies/linux-device-health.yml
+  - path: ../lib/windows/policies/windows-device-health.yml
+  - path: ../lib/linux/policies/disk-encryption-check.yml
 queries:
   - path: ../lib/macos/queries/collect-failed-login-attempts.yml
   - path: ../lib/all/queries/collect-fleetd-information.yml
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index ee04452c01..1b5b3244d4 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -83,13 +83,11 @@ controls:
     - path: ../lib/windows/scripts/remove-fleetd.ps1
     - path: ../lib/windows/scripts/turn-off-mdm.ps1
 policies:
-  - path: ../lib/macos/policies/device-health.yml
+  - path: ../lib/macos/policies/1password-emergency-kit-check.yml
   - path: ../lib/macos/policies/update-firefox.yml
-  - path: ../lib/macos/policies/cis.yml
   - path: ../lib/macos/policies/latest-macos.yml
-  - path: ../lib/windows/policies/device-health.yml
-  - path: ../lib/windows/policies/cis.yml
-  - path: ../lib/linux/policies/linux-device-health.yml
+  - path: ../lib/windows/policies/windows-device-health.yml
+  - path: ../lib/linux/policies/disk-encryption-check.yml
 queries:
   - path: ../lib/macos/queries/collect-failed-login-attempts.yml
   - path: ../lib/all/queries/collect-usb-devices.yml