Gatekeeper
Overview
Evidence: Gatekeeper
Description: Collect Gatekeeper details
Category: System
Platform: macos
Short Name: gatek
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Gatekeeper is macOS’s security feature that controls which applications can run on the system. This data is essential for understanding application security policies, detecting bypassed controls, and investigating application-based incidents.
Data Collected
This collector gathers structured data about gatekeeper.
Gatekeeper Data
| Field | Description | Example |
|---|---|---|
AssessmentEnabled | Assessment Enabled | 123 |
DevIDEnabled | Dev ID Enabled | 123 |
Version | Version | Example value |
OpaqueVersion | Opaque Version | Example value |
Collection Method
This collector queries the gatekeeper table via osquery and collects related policy files under /var/db/SystemPolicyConfiguration/.
Forensic Value
This evidence is crucial for forensic investigations as it reveals Gatekeeper configuration and state, helping identify weakened protections or policy tampering.