Tales from Developing and Deploying Endpoint Security in Osquery

The talk looks at the practical problems of shipping a macOS agent that uses Apple's Endpoint Security framework, with the osquery project as a worked example. The speaker argues that writing the monitoring code was the easier part, and that packaging and distributing the binary to machines the developer does not control was the harder task. The Endpoint Security headers are well documented, but the surrounding requirements were, at the time, unclear.

The talk then follows the steps in order. It starts with weak linking and availability checks, so the tool runs on older macOS releases without crashing when symbols are missing. Next is the entitlement request process, which the speaker describes as slow and opaque. Provisioning profiles come after that: a per-device profile is useful for local testing, while an embedded profile tied to a distribution certificate is needed for general release. Because osquery is a command-line tool, it has to be wrapped in an app bundle to carry that profile, and the speaker first built the bundle by hand before porting it to CMake and CPack. Code signing, product signing and notarization are then automated in GitHub Actions on a macOS runner that uses a temporary keychain.

The end result is a signed installer that passes Gatekeeper and can use Endpoint Security on target machines. The speaker closes by pointing to new event types in later macOS releases as the reason the effort is worthwhile, and notes that the code is open source for others to extend. Questions covered whether Apple adds requested event types and how to test them on newer systems.