https://github.com/osquery/osquery logo
Title
d

defensivedepth

03/15/2021, 6:36 PM
Also - sounds like a really neat blog post
c

CptOfEvilMinions

03/15/2021, 6:37 PM
Thanks! I know it's something the community has requested. While AWS is an option and I am considering it..... I am not thrilled about the cost. It's very $$$$$ to run a macOS VM in AWS.
z

zwass

03/15/2021, 6:42 PM
GitHub Actions macOS runner in a public repo?
๐Ÿ‘ 1
s

SK

03/15/2021, 6:44 PM
Also had some succes with the method @zwass is describing.
d

defensivedepth

03/15/2021, 6:44 PM
nice, I didnt realize GH actions had added MacOS
z

zwass

03/15/2021, 6:44 PM
Yes and totally free for public repos ๐Ÿ˜„
๐Ÿ’ฏ 1
d

defensivedepth

03/15/2021, 6:44 PM
that seems probably more affordable
z

zwass

03/15/2021, 6:45 PM
I suppose that may not play nice with the "Gitlab" angle of this blog post
Example usage of my own.
c

CptOfEvilMinions

03/15/2021, 6:57 PM
Itโ€™s good to know Github actions support MacOS. It might a good complimentary addition. But I would like to stick with Gitlab.
z

zwass

03/15/2021, 6:58 PM
I do manual testing with macOS VMs on macOS (this is allowed).
w

WS

03/16/2021, 1:52 AM
i saw this today https://github.com/sickcodes/Docker-OSX
๐Ÿ‘€ 1
๐Ÿ˜›artyparrot: 2
z

zwass

03/16/2021, 1:53 AM
Oh my. Life changer if it works. Thank you @WS!
w

WS

03/16/2021, 1:54 AM
๐Ÿ™‚
c

CptOfEvilMinions

03/19/2021, 5:27 PM
So I had an epiphany last night on this topic. Wanted to get some feedback on the idea. So the reason for spinning up a macOS VM with a Gitlab runner is to test an Osquery macOS specific config. As discussed above there is no good way to do this. So my epiphany is based on an assumption. If you want to test a macOS specific Osquery config you probably have macOS endpoints connected to Fleet. Therefore, instead of using a Gitlab runner to test my config, I would parse all the queries out of the config, and use the FleetCTL tool to test the queries on macOS endpoints.
w

WS

03/19/2021, 5:29 PM
so using an actual host?
c

CptOfEvilMinions

03/19/2021, 5:29 PM
Yes.
w

WS

03/19/2021, 5:29 PM
are you going to use a test machine? because then you have to account for it going offline right
if you had an unlimited budget, would you use the macos vm on AWS?
c

CptOfEvilMinions

03/19/2021, 5:35 PM
The idea of using Fleet would be to query live macOS hosts that ideally would be a set of test hosts and online.
I think running a macos based VM in AWS could be a good method. However, if your Gitlab instance is behind NAT it creates a roadblock.