How to List Munki Installs Across All Macs
Using Kolide, you can easily view and query Mac Munki Installs across your fleet.
Introduction
This inventory displays a record of all software installed by the macOS software management tool Munki.
The Munki project describes itself as:
Munki is a set of tools that, used together with a webserver-based repository of packages and package metadata, can be used by macOS administrators to manage software installs (and in many cases removals) on macOS client machines.
For more information about the Munki project, please refer to its official website: The Munki Project and the GitHub project.
What Mac Munki Install Data Can Kolide Collect?
Kolide's endpoint agent bundles in osquery to efficiently collect Mac Munki Installs from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.
Kolide meticulously documents every piece of data returned so you can understand the results.
Mac Munki Installs Schema
| Column | Type | Description | |
|---|---|---|---|
| id | Primary Key |
Unique identifier for the object |
|
| device_id | Foreign Key |
Device associated with the entry |
|
| device_name | Text |
Display name of the device associated with the entry |
|
| ended_at | Timestamp |
Date/time at which installation ended |
|
| installed | Boolean |
|
|
| name | Text |
The name of the software package installed (eg. |
|
| installed_version | Text |
The text representation of the version |
|
| installed_version_major | Bigint |
|
|
| installed_version_minor | Bigint |
|
|
| installed_version_patch | Bigint |
|
|
| installed_version_subpatch | Bigint |
|
|
| installed_version_pre | Text |
|
|
| installed_version_build | Text |
|
|
| collected_at | Timestamp |
Time the row of data was first collected in the database |
|
| updated_at | Timestamp |
Time the row of data was last changed in the database |
|
What Can You Do With This Information?
Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:
SELECT name, installed, ended_at installed_version, installed_version_major, installed_version_minor, installed_version_patch FROM mac_munki_installs WHERE name = 'slack' AND installed = 1| device_name | name | installed | ended_at | installed_version | installed_version_major | installed_version_minor | installed_version_patch |
|---|---|---|---|---|---|---|---|
| kangaroo | slack | true | 2022-06-26T19:03:19.000Z | 4.46.99 | 4 | 46 | 99 |
| conference-room-zoom | slack | true | 2022-06-25T21:54:13.000Z | 4.46.99 | 4 | 46 | 99 |
| bamboo | slack | true | 2022-06-26T19:06:21.000Z | 4.46.99 | 4 | 46 | 99 |
Why Should I Collect Mac Munki Installs?
IT and Security Administrators can review this inventory to verify intended packages have been deployed to end-user devices by Munki as expected.
End-User Privacy Consideration
Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.
When you use Kolide to list Mac Munki Install data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.
