Andrea
03/03/2022, 6:29 PMMike Myers
03/04/2022, 12:04 AMAndrea
03/04/2022, 6:22 PMMike Myers
03/04/2022, 8:03 PMAndrea
03/05/2022, 11:16 AMMike Myers
03/08/2022, 5:14 PMAndrea
03/09/2022, 2:31 PMMike Myers
03/09/2022, 5:18 PMAndrea
03/10/2022, 9:00 AM<key>PayloadDescription</key>
<string>osqueryd</string>
<key>PayloadDisplayName</key>
<string>osqueryd</string>
<key>PayloadIdentifier</key>
<string>BDBD19F2-A35A-4AEC-9E96-3CA7E2994666</string>
<key>PayloadOrganization</key>
<string>Trail of Bits</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>89121197-3B5F-4502-BB8C-4331261D3B8C</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Services</key>
is it something that the MDM software does or me as distributor should provide the configuration file?Mike Myers
03/16/2022, 9:03 PMPayloadOragnization
(your organization distributing the profile, I believe, but it's a freeform field) and CodeRequirement
CodeRequirement
is derived from codesign -dr - /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
The resulting output includes (at least at the time the wiki was written) the string identifier "io.osquery.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "3522FA9PXF"
which<key>PayloadIdentifier</key>
<string>BDBD19F2-A35A-4AEC-9E96-3CA7E2994666</string>
This is not something specific to osquery. It's probably a choice of the MDM software. You could probably even use this exact ID, but, probably better if not everyone did thatAndrea
03/17/2022, 1:44 PM