XCSSET v40: SoftwareUpdate ConfigDataInstall+RSR Disabled via defaults write (MDM-excluded)
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Microsoft Sentinel (KQL)

