Kolide

Kolide is an endpoint security and device trust platform that helps organizations monitor, manage, and secure employee devices (endpoints) across their workforce. It provides comprehensive visibility into the security posture and compliance status of laptops, desktops, workstations, and mobile devices used by employees, whether they are company-owned or bring-your-own-device (BYOD).

Category	Device management
Direction	Query source
Sign-in	API Token
Query languages	SQLite
Website	kolide.com

Before you start

Huntbase signs in to Kolide with API Token. Create the credential in Kolide first, then keep it to hand for the Connect step.

1. Sign in to Kolide (now 1Password Device Trust) as an administrator with Full Access.
2. Click your avatar in the upper-right corner and select Settings.
3. Click Developers in the left menu, then API Keys, then Create New Key.
4. Enter a key name and the responsible administrator, and save.
5. Copy the token from the table with the duplicate (copy) button.

Permissions:

• Read-only, which is the default for new keys. Don't grant write permissions.

Watch out for

• Kolide API tokens don't expire, so plan to rotate and revoke them yourself.

For the vendor's own instructions, see 1Password Device Trust (Kolide) API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Kolide

1. Go to Connections and click New connection, or click New connection on the Kolide product page.
2. On Product, pick Kolide and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials

The only Method is API Token. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
API Token	Yes	The secret token, which starts with a prefix such as k2sk_v1_. Secret — not shown again after you save it.

Query it

Once connected, Kolide can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL across this source and every other connected source.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog