(/var/db/SystemPolicy [GateKeeper configuration], etc.) System APIs (Apple System Log, Keychain, SMC, CoreFoundation, etc.) Application APIs (Docker, Carbon Black, etc.) Event-based APIs (FSEvents, OpenBSM, etc.) Filesystem (Shared folders, file hashes, permissions, etc.) Plists (/Library/Managed\ Installs/* [Munki data], etc.)
... All available under the same SQL interface