MSP Config Generator

Pick your policy settings and get ready-to-push files for every platform. For raw templates and per-browser paths, see the deployment templates.

Managing multiple clients? The Osprey Management Console fills these values in per client, hosts the config and reporting endpoints for you, and pushes later policy changes to every enrolled device without re-generating or re-deploying files.

Identifiers & backendProxy base URLRoute every lookup to your self-hosted proxy. Leave empty to use the public backend.Proxy API keyPer-tenant key sent to a self-hosted proxy as the X-Osprey-Tenant-Key header. Only sent when the proxy base URL is set.Device tagOpaque per-endpoint identifier attached to reported events.Site IDOpaque per-client identifier attached to reported events.

Central management & reportingManaged config URLHosted JSON document fetched on startup and every 60 minutes. Locally pushed policies always win over fetched values. Can only be set through managed storage.Reporting endpointReceives detection and override events and periodic health heartbeats. Leave empty to send nothing.Reporting auth tokenSent as "Authorization: Bearer <token>" on every reporting request.

Running your own receiver? After deploying, verify events and heartbeats actually arrive with the reporting setup checker. It is not needed with the management console, where enrolled devices appear on the Devices page directly.

These four values are exactly what the Osprey Management Console provides and hosts automatically. Console customers should use the console's Enroll devices page instead of filling them in here.

BrandingProduct nameLogo URLSupport URLSupport emailCustom block message

Branding keys apply through managed storage only. They are not part of the importable settings file.

Allow & block listsManaged allowlistAlways treated as safe. One host or URL pattern per line. Users cannot remove these.Managed blocklistAlways blocked, before the providers run. One host or URL pattern per line.

Interface lockdown

Disable user allowlistLock provider settingsHide provider controlsHide warning proceed buttonHide warning report buttonLock user allowlistDisable settings resetDisable third-party providers

Cache & API keysCache expiration (seconds)Between 60 and 2592000. Leave empty to keep the default.MetaDefender API keyManaged key for the MetaDefender integrations.

Threat providers

AlphaMountain (Default: On)BforeAI PreCrime (Default: On)ChainPatrol (Default: On)iZOOlogic (Default: On)PrecisionSec (Default: On)AdGuard DNS (Default: On)Artists Against 419 (Default: On)Cloudflare (Default: On)Control D (Default: Off)OpenPhish (Default: On)Phishunt.io (Default: On)Quad9 (Default: On)Red Flag Domains (Default: On)SinkingYachts (Default: On)Switch.ch (Default: On)THREATfox (Default: On)URLhaus (Default: On)URLAbuse (Default: On)Validin (Default: On)

Advanced provider tuning

Per-provider overrides pushed as ManagedProviderSettings. Add a row to tune the block threshold, request timeout, or block categories for one provider.

Browser

How to use each output

Windows .reg: double-click to import for a quick test, or fold the values into your Group Policy deployment. Uses the selected browser's registry root.
macOS plist: hand to an MDM that takes a custom plist, or use it as the payload for a configuration profile.
Linux JSON: save to the managed-policy directory for the selected browser, for example, /etc/opt/chrome/policies/managed/osprey.json.
Group Policy (ADMX): import Osprey.admxand Osprey.adml first, then set each listed policy to the value shown.
Firefox: Firefox ignores Chromium managed storage. Deploy the native managed-storage manifest shown here.
Extension import: an osprey-settings file a user can import from the extension's settings page. It carries provider and interface settings, not branding.

Something not working?

Send us a message or create an issue on GitHub.
We'll get back to you as soon as we can.