Hi! I'm thinking of building and deploying a custom osquery package with a few tables removed e.g.

process_envs

and

mdfind

to a couple hundred macOS devices. It would be best if this package can be autoupdated, but I'm guessing it may not be so straightforward as the code base has diverted from the upstream. Is this something that can be done with Kolide

launcher

,

package-builder

and the

--autoupdate

flag?

The auto update stuff will download launcher and osquery from our distribution points and replace them on local disk

My understanding is that I would be removing certain

.table

files under the specs path before I build the binary from the source as explained here. If auto update replaces this binary with the one from kolide's distribution points, I guess I'll likely be looking for an alternative. Would you know any areas I could possibly look into for this? Would it be possible to tweak auto update to point to a custom distribution point hosting my custom build?

Would it be possible to tweak auto update to point to a custom distribution point hosting my custom build?

Yes you could definitely do this but it's a lot of work.

Would you know any areas I could possibly look into for this?

Maybe you could use

--osquery_flag disable_tables=mdfind,process_envs

with Launcher and avoid having any custom package.

There’s no tweaking. per se, launcher supports arbitrary update servers. But setting up

notary

is a bit of a bear