Never mind, just found this. facepalm

@jamescapen did you find a solution or this? Which endpoints did you restrict and expose?

We're still in the process of standing up our instance and will work on exposing parts of it to the internet next week. We'll probably only expose

/api/osquery

and

/api/v1/osquery

since we won't be using the desktop app or MDM features.

Same. I am gonna setup a WAF in AWS to get those endpoints locked down.