Valerius66

Hi, Can we please add an option to prompt the user if Cisco Orbital and osquery should be installed and/or enabled, before this happens? Maybe at installation time then as an option in the "Scan Settings" ? From Cisco: https://orbital.amp.cisco.com/help/what-is-orbital/ " Cisco Orbital is a service that uses Osquery to provide you and your applications with information about your hosts. Osquery exposes an entire operating system as a relational database that you can query with SQL to gather information about the host. Orbital can be used by both Cisco customers and their applications to query their computers wherever Orbital has been deployed. " Orbital, in the context of a privately owned endpoint, is a very intrusive tool and should not be enabled by default. Thank you.

Thanks Ritchie, Really no advantage to the end user to run Orbital. Cisco doesn't need to know things like my hostname, which applications I'm running, which certificates I have installed, which services I have running etc. Basic description of Cisco Orbital: (https://orbital.amp.cisco.com/help/what-is-orbital/) "Cisco Orbital is a service that uses Osquery to provide you and your applications with information about your hosts. Osquery exposes an entire operating system as a relational database that you can query with SQL to gather information about the host. Orbital can be used by both Cisco customers and their applications to query their computers wherever Orbital has been deployed." I'm sure they have this covered somewhere in their policy, however, from the perspective of a privately owned endpoint, this is huge intrusion even for a free product. By all standards this is creepy big brother tool (check for "expose" in the summary). I will start a new topic.

Is there a way to disable both Orbital and osquery? Also, these should be clearly defined in Immunet's configuration settings. Both Orbital and osquery are intrusive tools/services that run alongside Immunet and should not be enabled by default without prompting the user. Thank you.