fleet/schema/tables/xprotect_meta.yml

name: xprotect_meta
description: "This Mac's browser-related [XProtect](https://support.apple.com/en-ca/guide/security/sec469d47bd8/web) signatures."
columns:
  - name: identifier
    description: "Browser extension or plugin [identifier](https://fleetdm.com/tables/safari_extensions)"
  - name: min_version
    description: "The minimum allowed plugin version, or 'any' if no version is allowed."
examples: >-
  See the minimum version of specific components allowed by Xprotect. This
  usually means the previous versions have vulnerabilities that are being
  exploited at scale, or were exploited at scale at some point in time.

  ```

  SELECT * FROM xprotect_meta WHERE min_version!='any';

  ```