I can’t quote the exact details but my understanding was a certain set of paths are checkin and a certain set are admin so you can isolate by path. Kolide or more Kolide-able people may have insight.

Is there any more context on what that entails? I'm pretty good at digging if I have a service or terminology given to me.

Sorry for the delayed reply as I've been on vacation. What you can do is use a reverse proxy to expose only the

/api/v1/osquery

endpoints to the public (so osquery agents can check in from any network), while requiring everything else to be routed through your VPN.