Title
#macos
clong

clong

07/09/2021, 5:10 PM
Has anyone been successful getting an endpoint security entitlement from apple? I’d love to implement the new tables without disabling SIP but reached out to someone there and got the usual “sorry, no idea how long this will take” response. Really happy to have paid my $99 to have no SLA on getting an entitlement
s

seph

07/09/2021, 5:31 PM
osquery has an entitlement, and 5.0 will ship with it signed in place.
5:31 PM
We might be able to start seeing CI builds soon, but I we’re just in the midst of working through how the app bundle is going to look. (I’ve been told we need an app bundle for the entitelment)
clong

clong

07/09/2021, 5:32 PM
oooo nice. mind if i ask how long it took from apply → approval?
s

sharvil

07/09/2021, 5:33 PM
I have personally gotten the entitlement (on my personal dev account), after about 14 months -- they only granted a "development" version of it lol. On work and osquery foundation, I think having the DUNS number helped, it was ~2-4 months time, IIRC
clong

clong

07/09/2021, 5:33 PM
lol holy shit
s

sharvil

07/09/2021, 5:33 PM
and as Seph mentioned, we currently have an entitlement, and 5.0.0 will ship with endpointsecurity table!
clong

clong

07/09/2021, 5:33 PM
do you have to supply them with source code or?
5:33 PM
i already submitted the application but im wondering what comes next
s

seph

07/09/2021, 5:34 PM
Looks like I requested in in July of 2020, and it was granted in October.
s

sharvil

07/09/2021, 5:34 PM
nope, but they basically wanted a short "essay" on why you need it, I just pointed it to my github where I have contributed to osquery before
s

seph

07/09/2021, 5:35 PM
I wrote
osquery is an open source endpoint agent. It presents a sql-like interface to underlying OS apis. We're beginning to add support for the Endpoint Security API
and linked to the osquery website.
5:35 PM
But that was also the official osquery apple account. 🤷
clong

clong

07/09/2021, 5:35 PM
lol sounds absolutely foolproof for them 😛 surely no one could lie! thanks for the info, I guess I’ll set a reminder for myself for 4-6 months
s

seph

07/09/2021, 5:36 PM
If it’s stock osquery you want, you;ll have it “soon”. But I realize you might want more
clong

clong

07/09/2021, 5:36 PM
yeah im actually also writing an app in my spare time that requires it 😕 but at least i can test the osquery parts soon!
5:37 PM
application processes with no guaranteed maximum SLA are absolutely criminal
5:37 PM
“here, submit your application into this black hole where you can never follow up on it or plan around the time its going to take for you to get a response and just pray it happens one day” 🙄
Mystery Incorporated

Mystery Incorporated

07/10/2021, 2:58 AM
@clong and to add insult to injury they charge you for the "privilege" 🤪
clong

clong

07/10/2021, 2:59 AM
Yep. I actually had to contact support to get the privilege of spending $99 because my enrollment kept erroring out lol