diff --git a/handbook/queries/README.md b/handbook/queries/README.md index 5f41e983b1..2857b3011f 100644 --- a/handbook/queries/README.md +++ b/handbook/queries/README.md @@ -4,23 +4,24 @@ Fleet's standard query library includes a growing collection of useful queries f ### Queries -- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md) -- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md) -- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md) -- [Get installed Chrome extensions](./get-installed-chrome-extensions.md) -- [Get installed FreeBSD software](./get-installed-freebsd-software.md) -- [Get installed Homebrew packages](./get-installed-homebrew-packages.md) -- [Get installed Linux software](./get-installed-linux-software.md) -- [Get installed macOS software](./get-installed-macos-software.md) -- [Get installed Safari extensions](./get-installed-safari-extensions.md) -- [Get installed Windows software](./get-installed-windows-software.md) -- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md) -- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md) -- [Get System Logins and Logouts](./get-system-logins-and-logouts.md) -- [Get wifi status](./get-wifi-status.md) -- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md) -- [Get platform info](./get-platform-info.md) -- [Get USB devices](./get-usb-devices.md) +- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md)(macOS) +- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md)(macOS, Linux) +- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md)(macOS) +- [Get installed Chrome extensions](./get-installed-chrome-extensions.md)(macOS, Linux, Windows, FreeBSD) +- [Get installed FreeBSD software](./get-installed-freebsd-software.md)(FreeBSD) +- [Get installed Homebrew packages](./get-installed-homebrew-packages.md)(macOS) +- [Get installed Linux software](./get-installed-linux-software.md)(Linux) +- [Get installed macOS software](./get-installed-macos-software.md)(macOS) +- [Get installed Safari extensions](./get-installed-safari-extensions.md)(macOS) +- [Get installed Windows software](./get-installed-windows-software.md)(Windows) +- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md)(macOS) +- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md)(macOS) +- [Get System Logins and Logouts](./get-system-logins-and-logouts.md)(macOS) +- [Get wifi status](./get-wifi-status.md)(macOS) +- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md)(Windows) +- [Get platform info](./get-platform-info.md)(macOS) +- [Get USB devices](./get-usb-devices.md)(macOS, Linux) +- [Count Apple applications installed](./get-usb-devices.md)(macOS) ### Contributors diff --git a/handbook/queries/count-apple-applications-installed.md b/handbook/queries/count-apple-applications-installed.md new file mode 100644 index 0000000000..f08b07fa0c --- /dev/null +++ b/handbook/queries/count-apple-applications-installed.md @@ -0,0 +1,21 @@ +# Count Apple applications installed + +Count the number of Apple applications installed on the machine. + +### Support +macOS + +### Query +```sql +SELECT + COUNT(*) +FROM + apps +WHERE + bundle_identifier LIKE 'com.apple.%'; +``` +### Purpose +Informational + +### Remediation +N/A diff --git a/handbook/queries/get-installed-chrome-extensions.md b/handbook/queries/get-installed-chrome-extensions.md index 8e4ee96b49..05ef80078f 100644 --- a/handbook/queries/get-installed-chrome-extensions.md +++ b/handbook/queries/get-installed-chrome-extensions.md @@ -3,7 +3,7 @@ List installed Chrome Extensions for all users. ### Support -macOS +macOS, Linux, Windows, FreeBSD ### Query ```sql diff --git a/handbook/queries/get-usb-devices.md b/handbook/queries/get-usb-devices.md index a7c7b8677f..2f0254a9a8 100644 --- a/handbook/queries/get-usb-devices.md +++ b/handbook/queries/get-usb-devices.md @@ -3,7 +3,7 @@ Shows all USB devices that are actively plugged into the host system. ### Support -macOS +macOS, Linux ### Query ```sql