Hello,
I created an EA to pull the modification date from Xprotect so that admins can see what version of Xprotect is being used on client machines.
n.b. As Apple silently pushes Xprotect updates to clients if the service is enabled on the machine, the data this EA collects is a snapshot of Xprotect status at time of inventory and might not be the current status on a client machine.
To use, create a new EA that looks like this using the script below.
external image link
#!/bin/sh
#Pulls Sophos version string from Sophos Anti-Virus.app
XPROTECT=defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification
echo "<result>$XPROTECT</result>"
exit 0
jkb
