Commit Graph

1 Commits

Author SHA1 Message Date
Artemis Tosini
af4c3f7061
Add macOS CIS 5.3.1 (#10397)
This adds a new check about whether all APFS volumes are encrypted. I
needed to add a new table, and I took that opportunity to add another so
that osquery has all information from `diskutil apfs list -plist`.

Note that it is somewhat unclear whether to use the `encryption` or
`filevault` field in the query. FileVault is about whether the volume is
encrypted with a password and Encryption is about whether it is
encrypted at all, since all modern macs have hardware-backed disk
encryption.
2023-03-10 12:29:14 -05:00