Reorganize our it-and-security directory (#24278)

handbook/engineering/README.md

@@ -216,7 +216,7 @@ Domain name registrations are handled through Namecheap. Access is managed via 1
 
 It is [possible for end users to remove launch agents](https://github.com/fleetdm/confidential/issues/6088) (this is true not just for osquery, but for anything). 
 
-If the host has MDM turned on, use the `fleetctl mdm run-command` CLI command to push the XML file located at https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos-send-fleetd.xml to the device, which will reinstall fleetd.
+If the host has MDM turned on, use the `fleetctl mdm run-command` CLI command to push the XML file located at https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/commands/macos-send-fleetd.xml to the device, which will reinstall fleetd.
 
 If the host doesn't have MDM turned on or isn't enrolled to dogfood, it is beyond our ability to control remotely.
 

it-and-security/default.yml

@@ -1,5 +1,5 @@
 agent_options:
-  path: ./lib/agent-options.yml
+  path: ./lib/all/agent-options/agent-options.yml
 org_settings:
   features:
     enable_host_users: true
@@ -78,4 +78,4 @@ org_settings:
       host_batch_size: 0
 policies:
 queries:
-  - path: ./lib/collect-fleetd-update-channels.queries.yml
+  - path: ./lib/all/queries/collect-fleetd-update-channels.yml

it-and-security/lib/all/queries/collect-usb-devices.yml

@@ -6,5 +6,5 @@
   logging: snapshot
   min_osquery_version: ""
   observer_can_run: true
-  platform: ""
+  platform: darwin,linux
   query: SELECT model, vendor FROM usb_devices;

it-and-security/lib/all/queries/collect-vs-code-extensions.yml

@@ -7,6 +7,6 @@
   logging: snapshot
   min_osquery_version: ""
   observer_can_run: false
-  platform: ""
+  platform: darwin,linux,windows
   query: SELECT extension.name, extension.publisher, extension.version FROM users
     JOIN vscode_extensions extension USING (uid);

it-and-security/lib/collect-crowdstrike-info.queries.yml

@@ -1,8 +0,0 @@
-- name: Get Crowdstrike Falcon network content filter status
-  description: "Collects crowdstrike information"
-  query: |
-    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
-  interval: 300 # 5 minutes
-  observer_can_run: true
-  automations_enabled: false
-  platform: darwin,linux,windows

it-and-security/lib/macos-check-if-apple-silicon.queries.yml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: query
-spec:
-  name: Check if Mac has Apple silicon
-  query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e";
-# - name: Determine macOS cpu type as Apple Silicon
-#   automations_enabled: false
-#   description: Returns true if macOS cpu type is Apple Silicon.
-#   discard_data: false
-#   interval: 3600
-#   logging: snapshot
-#   min_osquery_version: ""
-#   observer_can_run: true
-#   platform: "darwin"
-#   query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e";

it-and-security/lib/macos/policies/upgrade-firefox.yml

@@ -0,0 +1,8 @@
+- name: macOS - Upgrade Firefox
+  query: SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '132.0.0') >= 0;
+  critical: false
+  description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues.
+  resolution: During maintenance, the Firefox app could be updated to the correct version or installed if it's missing.
+  platform: darwin
+  install_software:
+    package_path: "../software/mozilla-firefox.yml"

it-and-security/lib/macos/queries/check-if-apple-silicon.yml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: query
+spec:
+  name: Check if Mac has Apple silicon
+  query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e";
+  platform: "darwin"

it-and-security/lib/macos/queries/collect-failed-login-attempts.yml

@@ -8,7 +8,7 @@
   logging: snapshot
   min_osquery_version: ""
   observer_can_run: false
-  platform: ""
+  platform: "darwin"
   query: SELECT users.username, account_policy_data.failed_login_count, account_policy_data.failed_login_timestamp
     FROM users INNER JOIN account_policy_data using (uid) WHERE account_policy_data.failed_login_count
     > 0;

it-and-security/teams/company-owned-iphones.yml

@@ -16,10 +16,10 @@ controls:
     minimum_version: "17.6"
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/ios-restrictions.mobileconfig
-      - path: ../lib/configuration-profiles/ios-passcode-settings-ddm.json
-      - path: ../lib/configuration-profiles/ios-lock-screen-message.mobileconfig
-      - path: ../lib/configuration-profiles/ios-content-filtering.mobileconfig
+      - path: ../lib/ios/configuration-profiles/restrictions.mobileconfig
+      - path: ../lib/ios/configuration-profiles/lock-screen-message.mobileconfig
+      - path: ../lib/ios/configuration-profiles/content-filtering.mobileconfig
+      - path: ../lib/ios/declaration-profiles/passcode-settings-ddm.json
   scripts:
 policies:
 queries:

it-and-security/teams/servers-canary.yml

@@ -9,7 +9,7 @@ team_settings:
   secrets:
     - secret: $DOGFOOD_SERVERS_CANARY_ENROLL_SECRET
 agent_options:
-  path: ../lib/servers-canary.agent-options.yml
+  path: ../lib/all/agent-options/servers-canary.agent-options.yml
 controls:
   enable_disk_encryption: false
   macos_settings:

it-and-security/teams/servers.yml

@@ -9,7 +9,7 @@ team_settings:
   secrets:
     - secret: $DOGFOOD_SERVERS_ENROLL_SECRET
 agent_options:
-  path: ../lib/servers.agent-options.yml
+  path: ../lib/all/agent-options/servers.agent-options.yml
 controls:
   enable_disk_encryption: false
   macos_settings:

it-and-security/teams/workstations-canary.yml

@@ -65,71 +65,65 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
-      - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-content-caching.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-guest-account.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-guest-shares.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-media-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-doh.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enforce-library-validation.mobileconfig
-      - path: ../lib/configuration-profiles/macos-firewall.mobileconfig
-      - path: ../lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig
-      - path: ../lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig
-      - path: ../lib/configuration-profiles/macos-misc.mobileconfig
-      - path: ../lib/configuration-profiles/macos-prevent-autologon.mobileconfig
-      - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-update-notifications.mobileconfig
-      - path: ../lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig
-      - path: ../lib/configuration-profiles/macos-passcode-settings.json
+      - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
+      - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig
+      - path: ../lib/macos/configuration-profiles/firewall.mobileconfig
+      - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig
+      - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig
+      - path: ../lib/macos/configuration-profiles/misc.mobileconfig
+      - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
+      - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-update-notifications.mobileconfig
+      - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
+      - path: ../lib/macos/declaration-profiles/passcode-settings.json
   macos_setup:
     bootstrap_package: ""
-    enable_end_user_authentication: true
+    enable_end_user_authentication: false
     macos_setup_assistant: null
   macos_updates:
     deadline: "2024-12-04"
     minimum_version: "15.1.1"
   windows_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/windows-firewall.xml
-      - path: ../lib/configuration-profiles/windows-password.xml
-      - path: ../lib/configuration-profiles/windows-screen-lock.xml
+      - path: ../lib/windows/configuration-profiles/windows-firewall.xml
+      - path: ../lib/windows/configuration-profiles/windows-password.xml
+      - path: ../lib/windows/configuration-profiles/windows-screen-lock.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
   scripts:
-    - path: ../lib/collect-fleetd-logs.sh
-    - path: ../lib/macos-execute-disable-fleet-desktop.sh
-    - path: ../lib/macos-see-automatic-enrollment-profile.sh
-    - path: ../lib/macos-remove-old-nudge.sh
-    - path: ../lib/macos-mdm-migration.sh
-    - path: ../lib/macos-system-maintenance.sh
-    - path: ../lib/windows-remove-fleetd.ps1
-    - path: ../lib/windows-turn-off-mdm.ps1
-    - path: ../lib/windows-install-bitdefender.ps1
-    - path: ../lib/windows-enable-ms-defender.ps1
+    - path: ../lib/macos/scripts/collect-fleetd-logs.sh
+    - path: ../lib/macos/scripts/execute-disable-fleet-desktop.sh
+    - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh
+    - path: ../lib/macos/scripts/remove-old-nudge.sh
+    - path: ../lib/macos/scripts/mdm-migration.sh
+    - path: ../lib/macos/scripts/system-maintenance.sh
+    - path: ../lib/windows/scripts/remove-fleetd.ps1
+    - path: ../lib/windows/scripts/turn-off-mdm.ps1
+    - path: ../lib/windows/scripts/install-bitdefender.ps1
+    - path: ../lib/windows/scripts/enable-ms-defender.ps1
 policies:
-  - path: ../lib/macos-device-health.policies.yml
-  - path: ../lib/windows-device-health.policies.yml
-  - path: ../lib/linux-device-health.policies.yml
+  - path: ../lib/macos/policies/device-health.yml
+  - path: ../lib/macos/policies/upgrade-firefox.yml
+  - path: ../lib/windows/policies/device-health.yml
+  - path: ../lib/linux/policies/linux-device-health.yml
   - name: macOS - Check if latest version
-    query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15';
-    critical: false
+    query: SELECT 1 FROM os_version WHERE (major = '15' AND minor = '1' AND patch = '1');
+    critical: true
     description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability.
     resolution: We will update your macOS to the latest version.
     platform: darwin
-    calendar_events_enabled: false  
-  - name: macOS - MDM migration complete
-    query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Titanosauria2', 'Drew’s MacBook Pro2','fleetwoodmike2');
-    critical: false
-    description: Determines if the device has completed MDM migration to Fleet.
-    resolution: We will migrate your macOS MDM to Fleet.
-    platform: darwin
     calendar_events_enabled: false
   - name: macOS - System maintenance complete
     query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Drew’s MacBook Pro','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air');
@@ -138,14 +132,6 @@ policies:
     resolution: We will perform system maintenance on your device.
     platform: darwin
     calendar_events_enabled: true
-  - name: macOS - Upgrade Firefox
-    query: SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '132.0.0') >= 0;
-    critical: false
-    description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues.
-    resolution: During maintenance, the Firefox app could be updated to the correct version or installed if it's missing.
-    platform: darwin
-    install_software:
-      package_path: "../lib/software/mac-mozilla-firefox.yml"
   - name: macOS - Upgrade Slack
     query: SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.40.126') >= 0;
     critical: false
@@ -154,18 +140,18 @@ policies:
     platform: darwin
     calendar_events_enabled: false
 queries:
-  - path: ../lib/collect-failed-login-attempts.queries.yml
-  - path: ../lib/collect-fleetd-information.yml
-  - path: ../lib/collect-usb-devices.queries.yml
-  - path: ../lib/collect-vs-code-extensions.queries.yml
-  - path: ../lib/collect-software-permissions-system.queries.yml
-  - path: ../lib/collect-software-permissions-user.queries.yml
-  - path: ../lib/collect-crowdstrike-info.queries.yml
+  - path: ../lib/macos/queries/collect-failed-login-attempts.yml
+  - path: ../lib/all/queries/collect-fleetd-information.yml
+  - path: ../lib/all/queries/collect-usb-devices.yml
+  - path: ../lib/all/queries/collect-vs-code-extensions.yml
+  - path: ../lib/macos/queries/collect-software-permissions-system.yml
+  - path: ../lib/macos/queries/collect-software-permissions-user.yml
+  - path: ../lib/all/queries/collect-crowdstrike-info.yml
 software:
+  packages:
+    - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
   app_store_apps:
       - app_store_id: '803453959' # Slack Desktop
       - app_store_id: '1333542190' # 1Password 7 Desktop
       - app_store_id: '1477376905' # GitHub
       - app_store_id: '1152747299' # Figma
-  packages:
-    - path: ../lib/software/mac-mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)

it-and-security/teams/workstations.yml

@@ -36,33 +36,33 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
-      - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-content-caching.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-guest-account.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-guest-shares.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-media-sharing.mobileconfig
-      - path: ../lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-doh.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig
-      - path: ../lib/configuration-profiles/macos-enforce-library-validation.mobileconfig
-      - path: ../lib/configuration-profiles/macos-firewall.mobileconfig
-      - path: ../lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig
-      - path: ../lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig
-      - path: ../lib/configuration-profiles/macos-misc.mobileconfig
-      - path: ../lib/configuration-profiles/macos-prevent-autologon.mobileconfig
-      - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig
-      - path: ../lib/configuration-profiles/macos-passcode-settings.json
+      - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
+      - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig
+      - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig
+      - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig
+      - path: ../lib/macos/configuration-profiles/firewall.mobileconfig
+      - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig
+      - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig
+      - path: ../lib/macos/configuration-profiles/misc.mobileconfig
+      - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
+      - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
+      - path: ../lib/macos/declaration-profiles/passcode-settings.json
   macos_setup:
     bootstrap_package: ""
     enable_end_user_authentication: true
-    macos_setup_assistant: ../lib/automatic-enrollment.dep.json
+    macos_setup_assistant: ../lib/macos/enrollment-profiles/automatic-enrollment.dep.json
     software:
-      - package_path: ../lib/software/mac-google-chrome.yml # Google Chrome for macOS
-      - package_path: ../lib/software/mac-zoom.yml # Zoom for macOS
+      - package_path: ../lib/macos/software/google-chrome.yml # Google Chrome for macOS
+      - package_path: ../lib/macos/software/zoom.yml # Zoom for macOS
       - app_store_id: '803453959' # Slack Desktop
       - app_store_id: '1333542190' # 1Password 7 Desktop
   macos_updates:
@@ -74,29 +74,28 @@ controls:
     deadline_days: 7
     grace_period_days: 2
   scripts:
-    - path: ../lib/collect-fleetd-logs.sh
-    - path: ../lib/macos-see-automatic-enrollment-profile.sh
-    - path: ../lib/macos-remove-old-nudge.sh
-    - path: ../lib/install-update-homebrew.sh
-    - path: ../lib/windows-remove-fleetd.ps1
-    - path: ../lib/windows-turn-off-mdm.ps1
+    - path: ../lib/macos/scripts/collect-fleetd-logs.sh
+    - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh
+    - path: ../lib/macos/scripts/remove-old-nudge.sh
+    - path: ../lib/windows/scripts/remove-fleetd.ps1
+    - path: ../lib/windows/scripts/turn-off-mdm.ps1
 policies:
-  - path: ../lib/macos-device-health.policies.yml
-  - path: ../lib/windows-device-health.policies.yml
-  - path: ../lib/linux-device-health.policies.yml
-  - path: ../lib/macos-cis.policies.yml
-  - path: ../lib/windows-cis.policies.yml
+  - path: ../lib/macos/policies/device-health.yml
+  - path: ../lib/macos/policies/cis.yml
+  - path: ../lib/windows/policies/device-health.yml
+  - path: ../lib/windows/policies/cis.yml
+  - path: ../lib/linux/policies/linux-device-health.yml
   - name: macOS - Check if latest version
-    query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15';
-    critical: false
+    query: SELECT 1 FROM os_version WHERE (major = '15' AND minor = '1' AND patch = '1');
+    critical: true
     description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability.
     resolution: We will update your macOS to the latest version.
     platform: darwin
     calendar_events_enabled: false
 queries:
-  - path: ../lib/collect-failed-login-attempts.queries.yml
-  - path: ../lib/collect-usb-devices.queries.yml
-  - path: ../lib/collect-vs-code-extensions.queries.yml
+  - path: ../lib/macos/queries/collect-failed-login-attempts.yml
+  - path: ../lib/all/queries/collect-usb-devices.yml
+  - path: ../lib/all/queries/collect-vs-code-extensions.yml
   - name: Collect expiration date for MDM SCEP certificates
     description: "For the following issue: https://github.com/fleetdm/confidential/issues/4518. Returns expiration date for macOS hosts's MDM SCEP certs."
     query: "SELECT common_name, datetime(not_valid_after,'unixepoch') AS expires FROM certificates WHERE 'common_name' LIKE '%FleetDM Identity%';"
@@ -106,8 +105,8 @@ queries:
     observer_can_run: true
 software:
   packages:
-    - path: ../lib/software/mac-zoom.yml # Zoom for macOS
-    - path: ../lib/software/mac-google-chrome.yml # Google Chrome for macOS
+    - path: ../lib/macos/software/zoom.yml # Zoom for macOS
+    - path: ../lib/macos/software/google-chrome.yml # Google Chrome for macOS
   app_store_apps:
     - app_store_id: '803453959' # Slack Desktop
     - app_store_id: '1333542190' # 1Password 7 Desktop

website/config/routes.js

@@ -550,7 +550,7 @@ module.exports.routes = {
   'GET /try-fleet/sandbox':   '/try-fleet',
   'GET /try-fleet/waitlist':   '/try-fleet',
   'GET /endpoint-operations': '/endpoint-ops',// « just in case we type it the wrong way
-  'GET /example-dep-profile': 'https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/automatic-enrollment.dep.json',
+  'GET /example-dep-profile': 'https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/enrollment-profiles/automatic-enrollment.dep.json',
   'GET /vulnerability-management': (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? '?'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/software-management'+originalQueryString);},
   'GET /endpoint-ops': (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? '?'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/observability'+originalQueryString);},