Jump to content
Valerius66

Orbital and osquery - How to Disable

Recommended Posts

Is there a way to disable both Orbital and osquery? Also, these should be clearly defined in Immunet's configuration settings.

Both Orbital and osquery are intrusive tools/services that run alongside Immunet and should not be enabled by default without prompting the user.

Thank you.

Share this post


Link to post
Share on other sites

I'm sorry to say that the Orbital code can't be disabled or deleted once it's installed. It's now an integral part of how Immunet's protection works for you.

Not everyone gets the Orbital code actually. I never got the code installed on my PC. A person gets the Orbital code if Immunet detects one or more security weaknesses with your Operating System. That fills the gap for those possible vulnerabilities so to speak.

Interesting idea to let the user decide if he/she wants to use it though. You could start a new topic in the "Ideas" section of the forum regarding the subject. That's not a bad idea!

Regards, Ritchie...

  • Like 1

Share this post


Link to post
Share on other sites

Thanks Ritchie,

Really no advantage to the end user to run Orbital. Cisco doesn't need to know things like my hostname, which applications I'm running, which certificates I have installed, which services I have running etc.

Basic description of Cisco Orbital: (https://orbital.amp.cisco.com/help/what-is-orbital/)

"Cisco Orbital is a service that uses Osquery to provide you and your applications with information about your hosts. Osquery exposes an entire operating system as a relational database that you can query with SQL to gather information about the host. Orbital can be used by both Cisco customers and their applications to query their computers wherever Orbital has been deployed."

I'm sure they have this covered somewhere in their policy, however, from the perspective of a privately owned endpoint, this is huge intrusion even for a free product. By all standards this is creepy big brother tool :) (check for "expose" in the summary).

I will start a new topic.

 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...