Title
#fleet
k

KK

05/28/2021, 7:28 AM
Hey guys, how can I build an Orbit package with custom OSQuery flagfiles? I was expecting that I could pass in the flagfiles when I'm building the Orbit package, but I'm not seeing any command line argument that accepts flagfiles. Was checking the file here - https://github.com/fleetdm/orbit/blob/main/cmd/package/package.go The use case that I'm thinking is that I want to disable certain OSQuery tables on the clients with the
--disable_tables
such that the Fleet users cannot abuse the live query functionality to query potentially sensitive OSQuery tables.
zwass

zwass

05/28/2021, 5:18 PM
Good point. Orbit currently takes arbitrary osquery flags when running the binary, but we need to add it to the package tooling. Can you please file an issue with this request and we'll make sure it gets in for the stable release?
k

KK

05/31/2021, 2:12 AM
j

jake

09/14/2021, 3:51 AM
I do not know if this is addressed yet, but the way I found to do it is doing an override by platform. Set my Osquery Flags in the override. When Orbit Connects it pulls those flag files.