MacOS.System.Packages

Parse packages installed on Macs

name: MacOS.System.Packages
description: |
  Parse packages installed on Macs
parameters:
  - name: Length
    description: Size (in bytes) of output that will be returned
    type: int
    default: "100000000"
sources:
  - precondition: |
      SELECT OS From info() where OS = 'darwin'
    query: |
        LET packages = SELECT parse_json(data=Stdout) AS Json 
          FROM execve(argv=[
            "system_profiler", "-json", "SPApplicationsDataType"
          ], length=Length)

        SELECT  _name AS Name,
                get(field="version") AS Version, 
                path AS Path, 
                lastModified AS LastModified, 
                obtained_from AS ObtainedFrom,
                get(field="signed_by") AS SignedBy,
                arch_kind AS _Architecture
        FROM foreach(
           row=packages[0].Json.SPApplicationsDataType)