Restrictions

Admins
Home / Admins / Settings & Admin Tools / Restrictions

Restrictions

Restrictions allow Kolide administrators to limit access to certain features or agent data sources within Kolide.

Restricting Features

There are two ways to restrict access to features in Kolide.

Globally

When you restrict access to a feature, you disable it for every Kolide administrator regardless of their access level. This means the feature will not be present in the UI and any background capabilities associated with that feature are disabled.

Note:
Restricting access to a feature does not stop Kolide from collecting data associated with that feature. For example, if you disable viewing the Auth Logs, Kolide will still collect them.

To restrict a feature, follow these steps:

  1. Click your avatar in the upper-right corner of the app.
  2. Click Settings.
  3. Click Restrictions in the left sidebar menu.
  4. Tick the checkbox next to the feature(s) you wish to disable.
  5. Click Save (this action will be logged in the audit log).

For A Specific User

Kolide users with Limited Access can either be invited with specific feature restrictions or have features added/removed later.

To restrict a Kolide Admin’s access:

  1. Click your avatar in the upper-right corner of the app.
  2. Click Settings.
  3. Click Users & Access in the left sidebar menu.
  4. Locate the user you want to restrict and click Edit.
  5. In the modal that opens, ensure the Restricted Access radio button is selected. This will reveal Feature Restrictions options.
  6. Tick the checkbox next to the feature(s) you wish to disable.
  7. Click Save to apply the changes.

Data Source Restrictions

In addition to disabling access to features, you can also control which osquery tables Kolide administrators can query within the Live Query, Log Pipeline, and Custom Checks features.

You may not want your teammates to query certain tables because they may contain sensitive information or cause performance issues when queried recklessly (e.g., shell_history).

Note:
Adding a table to the blocklist DOES NOT impact any queries that already use those tables (including Kolide’s official Checks); instead, it prevents users from writing any new queries (or updating existing ones) that use the blocklisted tables.

Kolide Global Blocklist

Due to serious privacy or stability issues, Kolide bans the usage of the following osquery tables:

Table Name Reason
asl Returns 100k+ rows per device and is depreciated
carves Kolide does not support file carving
dns_cache Leaks sensitive user information
running_apps Exposes in-focus app on macOS, which we consider a privacy overreach
example Table exposes no functionality
kolide_app_icons Intended for Kolide internal use only
kolide_program_icons Intended for Kolide internal use only
kolide_airport_util Exposes BSSID which can be used to pinpoint a person’s exact location
kolide_wifi_networks Exposes BSSID which can be used to pinpoint a person’s exact location
kolide_nmcli_wifi Exposes BSSID which can be used to pinpoint a person’s exact location
windows_eventlog Causes osquery to hang on Windows when queried

Kolide Suggested Blocklist

In addition to the globally blocklisted tables, Kolide seeds your organization’s Kolide account with the following suggestions. Unlike the global blocklist, any administrator can remove these restrictions if desired.

Table Name Reason
shell_history Often contains clear-text credentials from engineers using CLI API tools
process_envs When run on servers, they can often contain secrets.
quicklook_cache Leaks user sensitive information
curl Can be used to obtain information from a privileged/internal network

Manage the Blocklist

To manage the osquery table blocklist, follow these steps:

  1. Click your avatar in the upper-right corner of the app.
  2. Click Settings.
  3. Click Restrictions in the left sidebar menu.
  4. Click Add/Remove Tables.

Adding Tables

To add a table, click Add Table at the bottom of the modal. In the text field that appears, type the name of the table you wish to add to the blocklist, then click Save.

Removing Tables

To remove a table, click the red X next to the table you wish to remove and then click Save.