osquery-defense-kit/incident_response/disk_encryption.sql

-- Retrieves the current disk encryption status for the target system.
--
-- interval: 86400
-- platform: posix
-- value: Identifies a system potentially vulnerable to disk cloning.
-- version: 1.4.5
select
  *
from
  disk_encryption;