Extension Attribut for XProtect version

tcandela
Valued Contributor II

does anyone have a working EA for getting the XProtect version? Looks like the previous one i used only worked up to macOS Catalina

VERSION=$( defaults read "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta" Version )

 

I'm testing this but it gives me a long list of install dates and versions.  I just want the most recent information (see below under the XProtectPListConfigData). Currently it's populating with about 20 other dates and version information from previous xprotect installs.

VERSION=$(system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData")

echo "<result>$VERSION</result>"

 

XProtectPlistConfigData:

Version: 2155
Source: Apple
Install Date: 2/3/22, 7:05 PM

 

so the EA looks like this from the computers inventory information. I just want the last of the install version and date information

today.JPG

3 REPLIES 3

tcandela
Valued Contributor II

i found this and it seems to get me the XProtect version installed

defaults read "/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist" CFBundleShortVersionString

scottlep
Contributor II

Isn't this already collected by default and shown in Security section of the computer inventory?

Screen Shot 2022-03-03 at 1.51.13 PM.png

tcandela
Valued Contributor II

@scottlep  thanks, i didn't realize that was available to see via the 'security' section.