diff --git a/docs/Contributing/Understanding-host-vitals.md b/docs/Contributing/Understanding-host-vitals.md index f4b6a1d362dc..1ccfdf0245d0 100644 --- a/docs/Contributing/Understanding-host-vitals.md +++ b/docs/Contributing/Understanding-host-vitals.md @@ -677,7 +677,7 @@ SELECT path AS installed_path FROM homebrew_packages WHERE type = 'cask' -AND NOT EXISTS (SELECT 1 FROM file WHERE file.path LIKE CONCAT(homebrew_packages.path, '/%%') AND file.path LIKE '%.app%' LIMIT 1); +AND NOT EXISTS (SELECT 1 FROM file WHERE file.path LIKE CONCAT(homebrew_packages.path, '/%%') AND file.directory LIKE '%.app' LIMIT 1); ``` ## software_macos_codesign diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index ddfa03d7c721..3055f929d1b1 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -909,7 +909,7 @@ SELECT path AS installed_path FROM homebrew_packages WHERE type = 'cask' -AND NOT EXISTS (SELECT 1 FROM file WHERE file.path LIKE CONCAT(homebrew_packages.path, '/%%%%') AND file.path LIKE '%%.app%%' LIMIT 1); +AND NOT EXISTS (SELECT 1 FROM file WHERE file.path LIKE CONCAT(homebrew_packages.path, '/%%%%') AND file.directory LIKE '%%.app' LIMIT 1); `), Platforms: []string{"darwin"}, DirectIngestFunc: directIngestSoftware,