How to List Operating Systems Across All Mac, Windows, and Linux Devices

Introduction

An operating system (OS) is system software that runs your computer hardware, software programs, and provides core services so that those programs can operate.

Kolide collects details about the operating system such as its version, its architecture and codenames utilized by the OS vendor for the operating system.

A note on multi-OS devices:

Each device in Kolide is associated with a single operating system. If you have multiple operating systems on the same device, Kolide will need to be installed on each to have visibility. For example, if you have a macOS device which has a Windows Bootcamp partition, it would need Kolide to be installed twice (once on each OS) and it would be represented as two distinct device enrollments in Kolide with OS-specific data.

What Operating System Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Operating Systems from Mac, Windows, and Linux devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Operating Systems Schema

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

SELECT 
    version, 
    COUNT(*) AS device_count 
FROM device_operating_systems 
WHERE name ILIKE '%mac%' 
GROUP BY version;

WITH
reference_version (ref_major,ref_minor,ref_patch) AS (
VALUES
  (12,3,1)
),
assemble_data AS (
  SELECT rv.*, version, major, minor, patch, build, device_name 
  FROM reference_version rv,
  device_operating_systems dos
  JOIN devices d ON d.id = dos.device_id
  AND d.type = 'Mac'
)
SELECT version, major, minor, patch, build, device_name
FROM assemble_data WHERE (
    -- Check major versions
            (ref_major > major)
    -- Check minor versions
        OR  (ref_major >= major
        AND ref_minor >  minor)
    -- Check build versions
        OR  (ref_major >= major
        AND ref_minor >= minor
        AND ref_patch >  patch)
  )

SELECT
  COUNT(d.*) FILTER (WHERE d.type = 'Mac') AS count_macs,
  COUNT(d.*) FILTER (WHERE d.type = 'LinuxDevice')AS count_linux,
  COUNT(d.*) FILTER (WHERE d.type = 'WindowsDevice') AS count_windows
FROM devices d;

Why Should I Collect Operating Systems?

Collecting information about the operating system of a device is a fundamental necessity of many IT departments. This data is used for a variety of purposes, including but not limited to:

• Monitoring patch deployment
• Identifying devices which are running unsupported or end-of-life operating systems
• Understanding the install-base of various platforms within your organization (eg. Mac vs Linux vs Windows)
• Identifying devices running non-stable (alpha or beta) releases of operating systems.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

No additional personally identifiable data is collected or transmitted as part of this inventory.

When you use Kolide to list Operating System data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.