diff --git a/README.md b/README.md index d219430..fe0cfd4 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ For production deployment, you should refer to the [osquery documentation](https | `file_lines` | Read an arbitrary file | Linux / macOS / Windows | Use the constraint `path` and `last` to specify the file to read lines from | | `filevault_users` | Information on the users able to unlock the current boot volume when encrypted with Filevault | macOS | | | `google_chrome_profiles` | Profiles configured in Google Chrome. | Linux / macOS / Windows | | +| `local_network_permissions` | Local network permission state for applications | macOS | Shows apps that have responded to the "Allow [app] to find devices on local networks?" prompt. Reads from `/Library/Preferences/com.apple.networkextension.plist`. State values: 0 = denied, 1 = allowed. | | `macos_profiles` | High level information on installed profiles enrollment | macOS | | `mdm` | Information on the device's MDM enrollment | macOS | Code based on work by [Kolide](https://github.com/kolide/launcher). Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited` present, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not. | | `munki_info` | Information from the last [Munki](https://github.com/munki/munki) run | macOS | Code based on work by [Kolide](https://github.com/kolide/launcher) |