Enable macOS EndpointSecurity and FDE profile

[allenhouchins]

Enable EndpointSecurity-based process and FIM events in fleet configs and add the Full Disk Access profile for macOS. Adds disable_endpointsecurity: false and disable_endpointsecurity_fim: false to agent_options in testing-and-qa.yml and workstations.yml (enables es_process_events and es_process_file_events). Adds an apple_settings.configuration_profiles entry in testing-and-qa.yml pointing to full-disk-access-for-fleetd.mobileconfig so osqueryd can inherit Full Disk Access.

Summary by CodeRabbit

• Chores
  • Enhanced macOS security monitoring by updating fleet configurations to enable endpoint security event tracking.
  • Added Full Disk Access configuration profile to support expanded security monitoring capabilities.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6caafdcd-2785-4ee8-a889-1db5e6aa8f37

📥 Commits

Reviewing files that changed from the base of the PR and between 4d82562 and c98065b.

📒 Files selected for processing (2)

• it-and-security/fleets/testing-and-qa.yml
• it-and-security/fleets/workstations.yml

---

Walkthrough

This PR enables macOS EndpointSecurity capabilities across fleet configurations. The testing-and-qa fleet receives a Full Disk Access configuration profile to grant osqueryd the necessary permissions for EndpointSecurity table access. Both testing-and-qa and workstations fleets have their macOS eventing configuration updated to explicitly enable EndpointSecurity process events and file-level integrity monitoring events through feature toggles.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch allenhouchins-evented-table-adds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}