site.yml

@@ -24,6 +24,6 @@
   strategy: linear
 
   roles:
-    - { role: ansible_lza_install_common, become: true }
-    - { role: ansible_lza_server_hardening, become: true }
+    #- { role: ansible_lza_install_common, become: true }
+    #- { role: ansible_lza_server_hardening, become: true }
     - { role: ansible_slub_osquery, become: true }

templates/kolide.flags.j2

+# Server
+tls_hostname={{ vault_fleet_host }}:{{ vault_fleet_port}}
+--tls_server_certs=/etc/osquery/fleet.pem
+# Enrollment
+--host_identifier=instance
 --enroll_secret_path=/etc/osquery/enroll_secret
---tls_server_certs=/etc/osquery/{{ vault_fleet_cert_name }}
---tls_hostname={{ vault_fleet_host }}:{{ vault_fleet_port}}
---host_identifier=uuid
---enroll_tls_endpoint=/api/v1/osquery/enroll
+--enroll_tls_endpoint=/api/osquery/enroll
+# Configuration
 --config_plugin=tls
 --config_tls_endpoint=/api/v1/osquery/config
 --config_refresh=10
+# Live query
 --disable_distributed=false
---disable_events=false
---disable_logging=false
 --distributed_plugin=tls
 --distributed_interval=10
 --distributed_tls_max_attempts=3
 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
 --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
+# Logging
 --logger_plugin=tls
 --logger_tls_endpoint=/api/v1/osquery/log
 --logger_tls_period=10
+# File carving
+--disable_carver=false
+--carver_start_endpoint=/api/v1/osquery/carve/begin
+--carver_continue_endpoint=/api/v1/osquery/carve/block
+--carver_block_size=2000000