How to List Apps Across All Macs

Introduction

The primary means of software installation on macOS are bundles called Apps. These .app bundles may include software installed by the operating system, by the end-user via download, or by the end-user via the App Store. This inventory catalogs all apps found on a device regardless of installation path, so long as they are registered with the macOS LaunchServices API and then enumerates various metadata about the application such as version, the executable binary run by the app, and whether the software is signed.

To see a similar list on your device, you can follow the steps below:

1. Click on the Apple menu at the top left of your screen,
2. Click the item labeled "About this Mac" in the drop-down
3. On the Overview tab of the About this Mac screen, click the button labeled "System Report..."
4. In the sidebar on the left, scroll down to the section labeled "Software", and then click on the subitem labeled "Applications"

Kolide additionally enriches the data returned by osquery, by also retrieving the icon data for all installed apps.

What Mac App Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Mac Apps from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Mac Apps Schema

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

SELECT 
  name, 
  bundle_identifier, 
  device_name, 
  last_opened_at
FROM mac_apps 
WHERE bundle_identifier ILIKE 'com.adobe%'
AND bundle_name IN(
    'Photoshop',
    'Photoshop CC'
    'Illustrator',
    'Illustrator CC',
    'After Effects',
    'Acrobat Pro',
    'Acrobat Pro DC',
    'InDesign',
    'InDesign CC',
    'Premiere Pro',
    'Premiere Pro CC',
    'Adobe Audition'
)
AND ( last_opened_at ISNULL
OR last_opened_at < (NOW() - interval '90 days')) 
AND last_opened_at IS NOT NULL
LIMIT 5

WITH 
chrome_stable_split AS (
  SELECT 
    version AS latest_stable, 
    version_major, 
    version_minor, 
    version_build, 
    version_patch 
  FROM google_chrome_latest_releases 
  WHERE channel = 'stable' 
  AND platform = 'mac'
)
SELECT
  ma.device_name, 
  bundle_short_version AS installed_version,
  latest_stable,
  CASE WHEN (
      bundle_short_version_major < version_major
   OR bundle_short_version_major <= version_major AND bundle_short_version_minor < version_minor
   OR bundle_short_version_major <= version_major AND bundle_short_version_minor <= version_minor AND bundle_short_version_patch < version_build
   OR bundle_short_version_major <= version_major AND bundle_short_version_minor <= version_minor AND bundle_short_version_patch <= version_build AND bundle_short_version_subpatch < version_patch
   ) THEN 'true' ELSE 'false' END AS chrome_requires_update
  
FROM mac_apps ma, chrome_stable_split 
WHERE bundle_identifier = 'com.google.Chrome' LIMIT 16

Why Should I Collect Mac Apps?

App installations are cataloged and tracked to facilitate a number of potential purposes, for example:

• Ensuring required software (VPN, Antivirus, Password Manager) is installed
• Discovering potential malicious software
• Tracking the install count of various licensed software (eg. Adobe Creative Suite, Microsoft Office)
• Finding unsigned software

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

An employer with access to your app installations can determine the following:

• What applications you have installed on your device (and the path of their installation)
• The most recent timestamp for when you last opened each application

When you use Kolide to list Mac App data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.