[macOS] Remove subqueries field in favor of having such queries directly within the clauses

microsoft / mdatp-devicecontrol

Microsoft Defender for Endpoint Device Control tools, samples, and resources.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-worldwide

MIT License

45 stars 36 forks source link

[macOS] Remove subqueries field in favor of having such queries directly within the clauses #18

Closed bryan-lipinski closed 1 year ago

bryan-lipinski commented 1 year ago

The groupId clause was recently added to queries for parity with the Windows DC policy implementation.  Since groupId is an 'aggregate' clause, it makes sense to align subqueries with this approach.  Now subqueries, can be defined directly within clause statements.