Query Runbook and Privacy Center Enhancements
As part of our commitment to honest.security, I am so excited to announce some major changes to our end-user accessible Privacy Center, which just went live.
We had two big goals with this feature.
The first was to give end-users more visibility into what Kolide can potentially collect about their device before they even decide to enroll. Secondly, we wanted to give end-users visibility into the ad-hoc queries which have run on their devices and other important events, like device assignment and re-assignment.
A lot is going on with this enhancement, so beyond documenting those changes in this post, I’ve also recorded a short video walkthrough of the new Privacy Center.
The Query Runbook
Our goal with Kolide is to enable security and IT teams to be open and transparent about the tools that run on company-provisioned devices and the data that they collect. Accordingly, we’ve updated the Privacy Center to give end-users an unprecedented level of detail about both of those topics.
Before today, users could request a download of all of their device’s Inventory data in a zip file. While this was a good start, it had two usability issues:
Users needed to enroll a device before they could understand what data was collected.
Users were forced to pore over undocumented CSV files that gave little insight into the meaning or intent of the data contained.
We’ve done our best to address both of these items and provide an unprecedented level of insight into the way Kolide works and why it collects what it does.
Data Kolide collects by default
Today, in the Kolide Privacy Center, you and your end-users can find an exhaustive list of the data that Kolide collects when certain devices are enrolled.
No one likes long text-based lists, so to make browsing the info easier, we’ve added beautiful iconography to represent each device property. If you want to know more about an item, simply click the link, and you’ll be sent to a detailed page explaining what that item is, the security/IT rationale for collecting it, and even potential privacy considerations.
Transparency into how data is collected from your device:
Additionally, you can explore the queries we run on our endpoint agent to collect data about a specific property.
Preview the data Kolide collects!
The most important capability for an individual who wants to understand more about what Kolide does and does not collect is previewing the data from properties before enrolling their device. To assist in this process, we’ve added examples of what the data sent to Kolide looks like.
This gives users the confidence they need to understand that their private data will not be transmitted.
All of this information is available for every single device property Kolide can collect. If you or your end-users have any concerns about collecting certain types of data, remember, you can now disable data collection for those items.
Personalized Audit Log
To further round out our commitment to transparency, we now maintain a separate audit log for each end-user in the system. Today, this audit log captures the following events:
- Automatic Device Assignment
- Manual Device Assignment (or unassignment)
- Device Removal
- Completed Live Queries
From now on, these audit logs are available to all end-users in the Privacy Center’s sidebar. You can even export the entire list to CSV for later review. We believe this capability will help foster trust between IT teams and end-users.
On certain events like Live Query, you and end-users can see additional details by simply clicking the event name.
In this case, the end-user can see who ran the query, what results were
returned, and even access a copy of the data sent from their device to Kolide.
Scheduled Queries
Before this enhancement, end-users had little visibility into endpoint data collection that organizations set up via our Logging Pipeline or through a feature called Continuous Running Live Queries.
To address this, we’ve added a new section to the Privacy Center called Scheduled Queries. It provides a complete list of all queries running on an end-user’s assigned devices and a list of queries that may run on devices they enroll in in the future.
Like our Query Runbook and Live Query Audit Logs, we allow the end-users to see informative details related to these queries.
Feedback
These new changes are available in the Privacy Center right now. We have a lot more planned in the future, and we cannot wait to hear your feedback about these new improvements.
