diff --git a/it-and-security/lib/macos-arm.queries.yml b/it-and-security/lib/macos-arm.queries.yml new file mode 100644 index 000000000000..f9f70e174b4d --- /dev/null +++ b/it-and-security/lib/macos-arm.queries.yml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: query +spec: + name: query_apple_silicon + query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e"; +# - name: Determine macOS cpu type as Apple Silicon +# automations_enabled: false +# description: Returns true if macOS cpu type is Apple Silicon. +# discard_data: false +# interval: 3600 +# logging: snapshot +# min_osquery_version: "" +# observer_can_run: true +# platform: "darwin" +# query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e"; \ No newline at end of file diff --git a/it-and-security/lib/macos-intel.queries.yml b/it-and-security/lib/macos-intel.queries.yml new file mode 100644 index 000000000000..43b8d7b1d95a --- /dev/null +++ b/it-and-security/lib/macos-intel.queries.yml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: query +spec: + name: query_apple_silicon + query: SELECT 1 FROM system_info WHERE cpu_type = "x86_64h"; +# - name: Determine macOS cpu type as Intel +# automations_enabled: false +# description: Returns true if macOS cpu type is Intel. +# discard_data: false +# interval: 3600 +# logging: snapshot +# min_osquery_version: "" +# observer_can_run: true +# platform: "darwin" +# query: SELECT 1 FROM system_info WHERE cpu_type = "x86_64h"; \ No newline at end of file diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml index 82f3b14ae65a..d34bd5c33d80 100644 --- a/it-and-security/teams/workstations.yml +++ b/it-and-security/teams/workstations.yml @@ -75,4 +75,12 @@ queries: interval: 300 automations_enabled: false observer_can_run: true - +software: + - url: https://zoom.us/client/latest/Zoom.pkg?archType=arm64 + pre_install_query: + path: ../lib/macos-arm.queries.yml + self_service: true + - url: https://zoom.us/client/latest/Zoom.pkg + pre_install_query: + path: ../lib/macos-intel.queries.yml + self_service: true