``` 10 30 PM LP process cpu seconds total Total user and sys

Question

``` 10 30 PM LP process cpu seconds total Total user and system CPU time spent in seconds TYPE process cpu seconds total counter process cpu seconds total 6737 64 HELP process max fds Maximum number of open file descriptors TYPE process max fds gauge process max fds 1 024e+06 HELP process open fds Number of open file descriptors TYPE process open fds gauge process open fds 57 HELP process resident memory bytes Resident memory size in bytes TYPE process resident memory bytes gauge process resident memory bytes 7 098368e+07 HELP process start time seconds Start time of the process since unix epoch in seconds TYPE process start time seconds gauge process start time seconds 1 61130246694e+09 HELP process virtual memory bytes Virtual memory size in bytes TYPE process virtual memory bytes gauge process virtual memory bytes 7 47896832e+08 HELP process virtual memory max bytes Maximum amount of virtual memory available in bytes TYPE process virtual memory max bytes gauge process virtual memory max bytes 1 HELP promhttp metric handler requests in flight Current number of scrapes being served TYPE promhttp metric handler requests in flight gauge promhttp metric handler requests in flight 1 HELP promhttp metric handler requests total Total number of scrapes by HTTP status code TYPE promhttp metric handler requests total counter promhttp metric handler requests total code= 200 8 promhttp metric handler requests total code= 500 0 promhttp metric handler requests total code= 503 0``` This information is available without logging to the fleet Any suggestion how to fix this Is there any config option available to bar from revailing this information to attackers

zwass · Answer

When folks have concerns about what is being exposed to the internet they usually use a strategy like <https defensivedepth com 2020 04 02 kolide fleet breaking out the osquery api web ui > to split endpoints by internal external network access