The current version of Orbit wraps 4.8 version of OSQuery

However, for the auto-updater part, I don't think Orbit is functioning correctly: Every 10 seconds, it is hitting my HTTP server (where I am hosting the updated binaries and the corresponding meta-data) and my HTTP-server is returning HTTP 400, most probably because my HTTP-server is not able to understand the request-data. Can someone please let me know if I need to configure anything specific on my HTTP server?

Hello, I'm trying to get on-demand queries to work. I have an nginx proxy that all the osquery clients talk to. In the nginx config I've got the below for the websocket connection

proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

On the other side I have fleet running on kubernetes across several clusters for redundancy. Sometimes on-demand queries will work and sometimes I'll get the below error:

Failed to load resource: the server responded with a status of 404 ()

bundle-ec4e3a98f99eeaa1006b.js:110 WebSocket connection to '<wss://fleetdm-testing.example.com/api/v1/fleet/results/198/dd3kiay2/websocket>' failed:

If I reduce the kubernetes deployments to a single deployment, everything works fine. Given that it's intermittent and works with a single cluster deployment, I suspect there is a handshake/routing issue happening at the kubernetes layer where responses are not landing where fleet expects them. Anyone got any thoughts on this?

Having issues updating fleet. Currently on Fleet v4.0.0-rc2 and when I tried to upgrade to the latest version (4.2.1) seems to have caused DB issues, was unable to login to the console anymore due to failed authentication. Did the usual download new binaries, prepare db, and start the fleet service. Not sure if there is maybe a known issue or special update instructions that i missed for this version update or do I have to do the versions in between as well to be safe. Using RDS MySQL version 8.0.23. For now just downgraded to previous version of fleet and restored DB, everything is working correctly again.

Hi, I made a fresh installation of fleet 4.2.1. I am unable to move pass the registration phase, as shown in image (Clicking finish does not do anything).I then downgraded it to 4.1.0 and it works. Not sure if anyone faced the same problem.

hey , i schedule my fleet audit logs to arrive once in 2 week but i need to check something very important dose any one know how to force fleet audit logs ?

There's a limit on the Host details page when listing users?

Hi all, It is not clear to me how should I write the configuration file (option.yml) used by

fleetctl apply -f

. For example if I wanna change

osquery_status_log_plugin

I can see in the docs the config file format:

osquery:
  status_log_plugin: firehouse

How should I write config file for fleetctl? I’ve tried something like:

---
apiVersion: v1
kind: options
spec:
  osquery:
    status_log_plugin: stdout

but nothing changed

through which function does client hit the server and how does orbit update osquery on client side, I mean what function is specific to that in orbit and like what is the work of tuf.fleetctl.com in this and what does it do, like does it help in updation or stuff like that and in how much time does client hit the server/poll the server or like server hits the client?

Anyone have time to work with a newbie on getting fleet/orbit going?

Hi all, I'm wondering if anyone might know/ or have any working use cases/ queries that would send these events to our SIEM when monitoring an endpoint using Fleetdm 1. Successful log on attempts 2. Failed log on attempts 3. When an application is opened/ run on Mac, Windows, or Linux 4. When installing/ updating a new application 5. Taking a screenshot of confidential doc/ powerpoint/ material (log entry could include document title, document metadata, endpoint/ user info, stored location)

Hello, is this a bug? I'm trying to delete an offline host and this happens. This is the response from the server.

{
  "message": "Validation Failed",
  "errors": [
    {
      "name": "base",
      "reason": "Error 1451: Cannot delete or update a parent row: a foreign key constraint fails (`fleet`.`host_software`, CONSTRAINT `host_software_ibfk_1` FOREIGN KEY (`host_id`) REFERENCES `hosts` (`id`))"
    }
  ]
}

Hi, thanks for fixing the segfault in 4.2.2. Unfortunately vulnerability scanner still doesn't work outside of docker.

error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.709543409Z"}
ror translating to CPE, skipping...","ts":"2021-08-20T11:12:32.70976741Z"}
"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.710017811Z"}
"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.710238713Z"}
3ecpe":"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.710462814Z"}
e":"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.710688215Z"}
ecpe":"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.710905216Z"}
3ecpe":"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.711120117Z"}
e-\u003ecpe":"error translating to CPE, skipping...","ts":"2021-08-20T11:12:32.711345619Z"}
eft on device","level":"error","msg":"analyzing vulnerable software: CPE-\u003eCVE","ts":"2021-08-20T11:12:36.756018754Z"}

It doesn't seem to download the vulnerability database either

Does fleet ever intend to build for arm64? Would be good to deploy on OCI A1 ampere ARM servers

Hi Team, I’m getting this error when clicking on any host after the upgrade to latest version of fleet.

500: Oh, something went wrong.
Please file an issue if you believe this is a bug.

Error 1305: FUNCTION fleetdb.JSON_ARRAYAGG does not exist

I wonder if there's a good tutorial out there on installing an osquery extension like this one? https://github.com/kolide/launcher/blob/669854121a1f2ac00d8506f74710b939a6066e8f/pkg/osquery/tables/munki/munki.go

Hey friends! What size MySQL database are people running in prod? Do y'all have a size recommendation?

Also:

fleet[10461]: {"component":"crons","cron":"vulnerabilities","err":"getting cpes for: increase-memory-limit: fts5: syntax error near \".\"","level":"error","software-\u003ecpe":"error translating to CPE, skipping...","ts":"2021-08-22T01:07:17.030214237Z"}

I just bump it to 3GB and it uses all the swap file once the vulnerability cron kicks on lol

Hi everyone, i have a question about SSL Cert rotation. Is there anyone who can advise on an efficient way to perform SSL cert rotation? Supposed you have 1000 agents registered to fleet manager, it would not be easy to do this. I can only think of setting a cron job in the instance and disabling SSL verification for the time being on fleetdm. But it doesnt seem to be the right way to do things. Any help is appreciated! Thank you!

Does anyone have a screenshot what a CVE looks like in the web UI?

Hey everyone, still struggling to troubleshoot why osquery is not using the os certs on Windows. Quick question, if we are terminating https at the load balancer, does the fleet server need the certs?

Question - where does fleet display the vulnerability/CVE information?

Am I just jumping the gun as I just finished getting everything set? I probably had the vul downloads happen prior to getting the host enrolled.

Hi! I ran into live queries issues after 4.2.2 update. When I try to make requests in UI fleet, they hang for a long time and the result does not appear ( With fleetctl, requests are executed every other time). I have similar issues after update to 3.12 https://osquery.slack.com/archives/C01DXJL16D8/p1622552140131300 P.S. the results of all queries from packs are executed and accepted on the server in the file osquery_results. And then they are loaded into Elastic. I have only problems with live queries from fleet UI and fleetctl.

Can someone point me to a description of the roles in FleetDM, Admin, Maintainer, and Observer?

Is there a way to aggregate or pull the information from the vulnerability reports from Fleet itself?

Hi there! We had to renew our wildcard certificate used by Fleet and osquery, but I'm struggling to get it to work with Fleet. The issuer changed and also we've gone from a SHA-256 cert to SHA-384 cert, I wonder if that might be a problem? I don't think so, looking at the Intermediate Mozilla cert docs (we're using

tls_compatibility: intermediate

in our Fleet settings) The error we get from osquery is:

Failed enrollment request to https://blabla (Request error: certificate verify failed) retrying...

The PEM bundle we're using works in other software, for example, we're using it in Nginx absolutely fine. Does anyone have any suggestions what we can try?

Hello! Anybody knows why in fleet logs the following logs could appear? {"component":"service","err":"failed to update host details: failed to save host users: insert users: Error 1213: Deadlock found when trying to get lock; try restarting transaction","ip_addr":"10.6.17.6:38404","level":"info","method":"SubmitDistributedQueryResults","took":"445.723719ms","ts":"2021-08-26T061239.167996893Z","x_for_ip_addr":"10.80.104.39"} We used 4.1.0 when I noticed a lot of such errors. I’ve just upgraded fleet up to 4.2.3, so far so good. But.. what these errors were caused by? What should we do to fix it?