Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
c
clong
07/09/2021, 5:10 PMHas anyone been successful getting an endpoint security entitlement from apple? I’d love to implement the new tables without disabling SIP but reached out to someone there and got the usual “sorry, no idea how long this will take” response. Really happy to have paid my $99 to have no SLA on getting an entitlement
s
seph
07/09/2021, 5:31 PMosquery has an entitlement, and 5.0 will ship with it signed in place.
We might be able to start seeing CI builds soon, but I we’re just in the midst of working through how the app bundle is going to look. (I’ve been told we need an app bundle for the entitelment)
c
clong
07/09/2021, 5:32 PMoooo nice. mind if i ask how long it took from apply → approval?
s
sharvil
07/09/2021, 5:33 PMI have personally gotten the entitlement (on my personal dev account), after about 14 months -- they only granted a "development" version of it lol. On work and osquery foundation, I think having the DUNS number helped, it was ~2-4 months time, IIRC
c
clong
07/09/2021, 5:33 PMlol holy shit
s
sharvil
07/09/2021, 5:33 PMand as Seph mentioned, we currently have an entitlement, and 5.0.0 will ship with endpointsecurity table!
👍 1
c
clong
07/09/2021, 5:33 PMdo you have to supply them with source code or?
i already submitted the application but im wondering what comes next
s
seph
07/09/2021, 5:34 PMLooks like I requested in in July of 2020, and it was granted in October.
s
sharvil
07/09/2021, 5:34 PMnope, but they basically wanted a short "essay" on why you need it, I just pointed it to my github where I have contributed to osquery before
s
seph
07/09/2021, 5:35 PMI wrote
osquery is an open source endpoint agent. It presents a sql-like interface to underlying OS apis. We're beginning to add support for the Endpoint Security APIBut that was also the official osquery apple account. 🤷
c
clong
07/09/2021, 5:35 PMlol sounds absolutely foolproof for them 😛 surely no one could lie!
thanks for the info, I guess I’ll set a reminder for myself for 4-6 months
s
seph
07/09/2021, 5:36 PMIf it’s stock osquery you want, you;ll have it “soon”. But I realize you might want more
c
clong
07/09/2021, 5:36 PMyeah im actually also writing an app in my spare time that requires it 😕 but at least i can test the osquery parts soon!
application processes with no guaranteed maximum SLA are absolutely criminal
“here, submit your application into this black hole where you can never follow up on it or plan around the time its going to take for you to get a response and just pray it happens one day” 🙄
m
Mystery Incorporated
07/10/2021, 2:58 AM@clong and to add insult to injury they charge you for the "privilege" 🤪
c
clong
07/10/2021, 2:59 AMYep. I actually had to contact support to get the privilege of spending $99 because my enrollment kept erroring out lol