The Kolide agent

Overview

The Kolide agent (also referred to as Kolide Launcher Agent) allows the Kolide service to communicate with Mac, Windows, and Linux devices. This article describes the agent’s capabilities and architecture across all of Kolide’s supported platforms.

Supported platforms

Kolide ships and supports agent installers for macOS, Windows, RPM-based Linux, and Debian-based Linux.

Unless otherwise noted, when Kolide claims support for a specific platform, it means:

• The installation packages work as expected.
• The agent persists itself across restarts.
• The uninstall process works.
• The menu bar app appears in the system tray and all the items work.
• The menu bar app can display system notifications to the end-user.
• The device trust local server operates as expected.
• The agent’s automatic update process works correctly.
• The osquery daemon interacts with the Kolide service correctly.
• Kolide official Checks work correctly.

Enabling Kolide for virtual environments

To enable Kolide for your virtual environments such as VMs or VDIs, the launcher database will need to be removed after install and before a user accesses the device. The database and its backups can be found at the following paths:

• macOS and Linux: /var/kolide-k2/k2device.kolide.com/launcher.db*
• Windows: C:\ProgramData\Kolide\Launcher-kolide-k2\data\launcher.db*

All of the files for both launcher.db and launcher.db.bak must be deleted after installation of the package. This allows for each new instance to be interpreted by Kolide as a new device, rather than as a duplicate of a previous device record.

Components

While Kolide’s agent is shipped in a single installer, it’s really a collection of technologies, each enabling different features and experiences within the Kolide service.

osquery and osquery extension

Kolide’s service requires regularly updated information about a device’s current posture. To achieve this, the Kolide agent installs and persists a fully functional osquery daemon that directly interacts with the Kolide service. On macOS, Kolide ships Osquery’s official app bundle which is imbued with Apple’s Endpoint Security entitlement, allowing customers to use osquery’s process event monitoring and file monitoring features on the Mac.

In addition, Kolide also includes an osquery extension that registers new virtual tables that provide additional device information that osquery cannot obtain otherwise.

All components of osquery are kept up-to-date using the agent’s Automatic Update Capabilities.

Menu bar app

Kolide’s agent includes a Menu Bar application that serves as an indicator of the current device’s registration status and health.

In addition to displaying device health, the app is also capable of sending on-device notifications that inform end-users about any changes in their registration status or device health.

Updater

Kolide’s agent is capable of updating any of its components through a secure and automatic update system.

Updater adheres to The Update Framework (TUF) specification. Kolide uses a mirror like Google Cloud Storage to store update targets, and the agent uses the Golang implementation of TUF to make sure that targets have not been tampered with.

Local server

The Kolide agent includes a web server that is only accessible through the local loopback interface (127.0.0.1) on a high-numbered port. Kolide uses this web server to identify devices accessing the service through a web browser and to issue commands to change the agent’s behavior (for example, asking the agent to check in more frequently for 5 minutes).

Kolide uses public-key authenticated encryption to encrypt and sign confidential messages between the Kolide Service and the Kolide Agent (specifically libsodium’s crypto_box). For more information, read About Kolide - Device Trust Architecture.

Agent watchdog

The Kolide Agent Watchdog is currently implemented for Windows devices to make sure automatic recovery if the Windows Service Control Manager agent is ever unable to start the Kolide Agent service. It is installed as a scheduled task, which queries the service state and issues a service start request if needed.

You can view the task in the Task Scheduler, under the name LauncherKolideK2WatchdogTask. The task is configured to trigger routinely on a 30 minute interval, as well as following wake and boot events to verify the service has been started successfully and is in a running state.

Network communication

The Kolide agent connects to several HTTPS endpoints that together make up the Kolide service. All outbound communication across the internet is on port 443.

The list of domains (last changed 2023-11) is:

• k2device.kolide.com
• k2control.kolide.com
• notary.kolide.co
• dl.kolide.co
• tuf.kolide.com
• ingest.kolide.com

Glad to hear it! If you have anything you'd like to add, feel free to contact us.

Sorry to hear that. Please contact us if you'd like to provide more details.