Hey guys, how can I build an Orbit package with custom OSQuery flagfiles? I was expecting that I could pass in the flagfiles when I'm building the Orbit package, but I'm not seeing any command line argument that accepts flagfiles. Was checking the file here - https://github.com/fleetdm/orbit/blob/main/cmd/package/package.go
The use case that I'm thinking is that I want to disable certain OSQuery tables on the clients with the
such that the Fleet users cannot abuse the live query functionality to query potentially sensitive OSQuery tables.
05/28/2021, 5:18 PM
Good point. Orbit currently takes arbitrary osquery flags when running the binary, but we need to add it to the package tooling. Can you please file an issue with this request and we'll make sure it gets in for the stable release?