Title
#general
defensivedepth

defensivedepth

03/15/2021, 6:36 PM
Also - sounds like a really neat blog post
CptOfEvilMinions

CptOfEvilMinions

03/15/2021, 6:37 PM
Thanks! I know it's something the community has requested. While AWS is an option and I am considering it..... I am not thrilled about the cost. It's very $$$$$ to run a macOS VM in AWS.
zwass

zwass

03/15/2021, 6:42 PM
GitHub Actions macOS runner in a public repo?
SK

SK

03/15/2021, 6:44 PM
Also had some succes with the method @zwass is describing.
defensivedepth

defensivedepth

03/15/2021, 6:44 PM
nice, I didnt realize GH actions had added MacOS
zwass

zwass

03/15/2021, 6:44 PM
Yes and totally free for public repos πŸ˜„
defensivedepth

defensivedepth

03/15/2021, 6:44 PM
that seems probably more affordable
zwass

zwass

03/15/2021, 6:45 PM
I suppose that may not play nice with the "Gitlab" angle of this blog post
6:46 PM
Example usage of my own.
CptOfEvilMinions

CptOfEvilMinions

03/15/2021, 6:57 PM
It’s good to know Github actions support MacOS. It might a good complimentary addition. But I would like to stick with Gitlab.
zwass

zwass

03/15/2021, 6:58 PM
I do manual testing with macOS VMs on macOS (this is allowed).
zwass

zwass

03/16/2021, 1:53 AM
Oh my. Life changer if it works. Thank you @WS!
w

WS

03/16/2021, 1:54 AM
πŸ™‚
CptOfEvilMinions

CptOfEvilMinions

03/19/2021, 5:27 PM
So I had an epiphany last night on this topic. Wanted to get some feedback on the idea. So the reason for spinning up a macOS VM with a Gitlab runner is to test an Osquery macOS specific config. As discussed above there is no good way to do this. So my epiphany is based on an assumption. If you want to test a macOS specific Osquery config you probably have macOS endpoints connected to Fleet. Therefore, instead of using a Gitlab runner to test my config, I would parse all the queries out of the config, and use the FleetCTL tool to test the queries on macOS endpoints.
w

WS

03/19/2021, 5:29 PM
so using an actual host?
CptOfEvilMinions

CptOfEvilMinions

03/19/2021, 5:29 PM
Yes.
w

WS

03/19/2021, 5:29 PM
are you going to use a test machine? because then you have to account for it going offline right
5:30 PM
if you had an unlimited budget, would you use the macos vm on AWS?
CptOfEvilMinions

CptOfEvilMinions

03/19/2021, 5:35 PM
The idea of using Fleet would be to query live macOS hosts that ideally would be a set of test hosts and online.
5:35 PM
I think running a macos based VM in AWS could be a good method. However, if your Gitlab instance is behind NAT it creates a roadblock.