Carbon Black Cloud: How to query for Mac OS patch level information in Live Response using Osquery?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Run an Osquery in Live Response to determine OS patch Level

Environment

• Carbon Black Cloud: All supported versions

Resolution

Run the following from Live Response:

SELECT key, subkey, value FROM plist WHERE path = '/Library/Receipts/InstallHistory.plist'