The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

macOS Disk Encryption

Source: https://www.uptycs.com/blog/osquery-tutorial-how-to-check-disk-encryption-on-mac-linux-and-windows

Description: macOS addressable disk devices encryption status

SQL:

SELECT m.device, m.device_alias, m.path, m.type, de.encryption_status

FROM mounts m

LEFT JOIN disk_encryption de ON de.name = m.device_alias

WHERE m.device LIKE '/dev/%'

ORDER BY m.device;

 

1 Comment
jnelson
Carbon Black Employee
Status changed to: Approved