Kolide's Inventory feature is designed to collect, enrich, and visualize important data from all enrolled devices in your fleet. While Kolide strives to strike a careful balance between the utility of the data collected and the privacy of end-users, some organizations may wish to exclude certain device properties from Kolide without having to resort to marking all devices as private. This article discusses how to opt-in and out of specific device properties in Inventory, and the effects those decisions will have on the rest of Kolide's product.

Disabling a device property will immediately cause Kolide to cease collecting any related data on applicable devices. In addition, administrators can choose hide or erase previously collected data.

Since Kolide uses the data collected in Inventory to power many other features in the product, disabling inventory can have far-reaching and unintended effects. These effects include:

* Osquery powered checks are unaffected by disabling device properties in Inventory.

When disabling a device property, Kolide will inform the administrator about these dependencies in detail so they can make an informed decision before they proceed. As an example, here is what an administrator might see when disabling the Chrome Extensions property.

To disable a device property in Inventory, follow these steps:

By default, Kolide will also delete any previously collected data associated with a device property. If this is undesirable, administrators can opt-out of this behavior by unchecking the option named delete all existing data collected by this inventory item. Instead of being deleted, the data will simply be hidden and inaccessible to administrators until the device property is re-enabled.

Note: By law, any hidden data will still be made available to end-users who wish to export all data Kolide associates with their account and device. End-users perform this action in Kolide's Privacy Center.

Kolide primarily uses osquery SQL to collect data from endpoints via its agent. While disabling a device property will stop Kolide from collecting this data, it may not prevent administrators from running new Live Queries or adding new Log Pipeline packs that collect similar data. To assist administrators, Kolide will offer to add the relevant virtual tables to your organization's osquery table block list.

Note: This feature is offered as an additional convenience to Kolide administrators and is not intended to be an exhaustive enumeration of every possible virtual table capable of collecting the target data. For example, while disabling the chrome_extensions table in osquery will prevent most administrators from accessing that data, it might be possible for a determined administrator to work around this restriction using utility tables like file or plist.

Kolide requires certain information from devices in order for its product to function correctly. When you attempt to disable device properties that would interfere with a critical function, the disable button will be unavailable as shown below.

For certain types of data that Kolide collects like apps, extensions, and packages, Kolide will group the data in Inventory so it is easy to count the number of installations across all devices. When disabling these "installables", administrators should be aware that any decisions made will also impact the individual installations in inventory.

Like other sensitive features, Kolide administrators can choose to hide this functionality from specific users, or from everyone using the existing access controls under Teams and Access or Device Privacy.

For previously disabled device properties (or certain device properties that are shipped disabled by default) administrators can easily enable them.

To do so, simply follow these steps:

If data was previously hidden (and not deleted), it will immediately re-appear. If data was deleted, it may take several hours before devices begin reporting this data into Kolide again.

When enabling a device property in Inventory, this may also make previously disabled Checks available. Administrators can choose to immediately enable these checks, or may do so at a later time by browsing the disabled tab on the Checks overview page.

As shown in the screenshot of the confirmation modal above, Kolide will advise administrators to remove any related virtual tables from their blocklist. This blocklist only applies to administrators writing new queries in Live Query or Log Pipeline and does not impact Kolide's ability to collect data from devices to populate Inventory.