What would make Fleet 10x better?

🏗️ New commits pushed to Fleet: - zwass: Make migrations compatible with GTID replication (#2615) - lucasmrod: By default, force password reset on CreateUser (#2570) - rlynnj11: cleaner_steps (#2624) - chiiph: Handle null resolution in host details (#2622) - lucasmrod: Fix

SearchHosts

to match for one-char and two-chars queries (#2590) - eashaw: Update pricing page styles (#2600) - eashaw: focus-visable -> focus (#2605) - eashaw: remove second growth link (#2634) - eashaw: Improve messaging on "Get started" page (#2631) - RachelElysia: Fix subsequent delete checkbox state (#2587) - RachelElysia: Dev X: Fix hosts.spec.ts commented out tests (#2610) - RachelElysia: Dev X: Destructure props in functional component's argument (#2582) - zwass: Update files for 4.4.3 release (#2636) - lukeheath: Fix broken links to docs (#2561) - zwass: Add dev DB management rules to Makefile (#2643) - lucasmrod: Perform early session check on

fleetctl

commands (#2620) - eashaw: Rename load testing documentation. (#2632) - noahtalerman: Add FAQ question and answer for "Why my host is not updating a policy's respo... - edwardsb: Add Cloudwatch monitoring to AWS Terraform configs (#2485) - RachelElysia: UI feature: Frontend of performance impact bubbles (#2589) - eashaw: Standard query library updates (#2546) - eashaw: disable default mobile select styles, adjust hover state padding (#2601) - gillespi314: Change default org name for fleet preview (#2642) - m4wh6k: Update Orbit README to reflect packaging now done with fleetctl (#2626) - zwass: Update fleetctl NPM dependencies (#2658) - mike-j-thomas: Add new blog link to transparency doc (#2654) - chiiph: Remove policies yaml for now and apply policies in preview (#2644) - RachelElysia: Packs UI: Create pack navigates to pack's edit page (#2581) - noahtalerman: Fix query syntax for several queries in the standard query library (#2664) - gillespi314: Surface query-platform compatibility in FleetUI (#2640) - lucasmrod: Make /refetch run labels and policies for the host (#2651) - mna: Allow empty TLS CA for Redis TLS connections (#2668) - zwass: Update osquery schema for 5.0.1 (#2661) Read more: https://github.com/fleetdm/fleet/commits/main

🏗️ New commits pushed to Fleet »

I’m back with some stupid questions about my ‘osquery-in-a-box’ setup. I’ve misplaced all working passwords for all created admin-users and I don’t have mail setup. What’s the simplest way to insert a password for an admin-user into the mysql-db (I do have root-access to mysql thanks to setting it up with the recommended ‘toor’ password… )

Just looking at the new API endpoint https://fleetdm.com/docs/using-fleet/rest-api#software for listing vulnerable software. Is there any way to surface that data to Fleet itself, so we could include it our queries and query packs?

What is the relation between the two tables?

I seem to recall that when

Usage Stats

was first introduced, there was some verbiage about it not being turned on by default for Upgrades, just new installs. I can't seem to find that right now, is this still correct?

I just tried to start over with

osquery-in-a-box

, but one of the docker containers just crashes immediately after start…

docker logs fleet-preview-server_fleet02_1
panic: unreachable
goroutine 1 [running]:
<http://github.com/fleetdm/goose.(*Client).GetDBVersion(0xc00003c300|github.com/fleetdm/goose.(*Client).GetDBVersion(0xc00003c300>, 0xc0005c81a0, 0x0, 0x0, 0x0)
        <http://github.com/fleetdm/goose@v0.0.0-20210209032905-c3c01484bacb/migrate.go:208|github.com/fleetdm/goose@v0.0.0-20210209032905-c3c01484bacb/migrate.go:208> +0x348
<http://github.com/fleetdm/fleet/v4/server/datastore/mysql.(*Datastore).MigrationStatus(0xc0000d5680|github.com/fleetdm/fleet/v4/server/datastore/mysql.(*Datastore).MigrationStatus(0xc0000d5680>, 0x1b08370, 0xc0000bc068, 0xc, 0xc000040015, 0x5)
        <http://github.com/fleetdm/fleet/v4/server/datastore/mysql/mysql.go:296|github.com/fleetdm/fleet/v4/server/datastore/mysql/mysql.go:296> +0x8c
main.createPrepareCmd.func2(0xc0000de840, 0xc0004fbc10, 0x0, 0x1)
        <http://github.com/fleetdm/fleet/v4/cmd/fleet/prepare.go:50|github.com/fleetdm/fleet/v4/cmd/fleet/prepare.go:50> +0x1af
<http://github.com/spf13/cobra.(*Command).execute(0xc0000de840|github.com/spf13/cobra.(*Command).execute(0xc0000de840>, 0xc0004fbc00, 0x1, 0x1, 0xc0000de840, 0xc0004fbc00)
        <http://github.com/spf13/cobra@v1.1.1/command.go:854|github.com/spf13/cobra@v1.1.1/command.go:854> +0x2c2
<http://github.com/spf13/cobra.(*Command).ExecuteC(0xc0000df340|github.com/spf13/cobra.(*Command).ExecuteC(0xc0000df340>, 0xc00063ff58, 0x1, 0x1)
        <http://github.com/spf13/cobra@v1.1.1/command.go:958|github.com/spf13/cobra@v1.1.1/command.go:958> +0x375
<http://github.com/spf13/cobra.(*Command).Execute(...)|github.com/spf13/cobra.(*Command).Execute(...)>
        <http://github.com/spf13/cobra@v1.1.1/command.go:895|github.com/spf13/cobra@v1.1.1/command.go:895>
main.main()
        <http://github.com/fleetdm/fleet/v4/cmd/fleet/main.go:29|github.com/fleetdm/fleet/v4/cmd/fleet/main.go:29> +0x1d3

Hello everyone! I'm having some performance issues when loading and searching queries on the new Fleet's 4.5.0 version. Anyone else relates that?

Why does it try to connect to

localhost

?

Is go a run-time requirement for using orbit, or is it just a build-time requirement?

I.e. can I build the package on one host and then distribute it to others that doesn’t have

go

installed?

Can I have the MySQL-container save it’s data-files somewhere persistent?

🏗️ New commits pushed to Fleet: - eashaw: fix code block and indentation (#2672) - eashaw: Fix broken markdown link in handbook (#2650) - lukeheath: Show team admins create policy buttons (#2732) - noahtalerman: Update permissions documentation (#2721) - lukeheath: Allow team admins to manage scheduled queries (#2738) - martavis: reset session for other user won't trigger logout (#2736) - eashaw: Update website footer layout (#2745) - chiiph: Make vulnerability processing less RAM hungry (#2739) - lucasmrod: Amend WriteTimeout for live queries GET sync API (#2752) - noahtalerman: Update policy passing icon filename and style on "Home" page (#2754) - noahtalerman: Prepare for Fleet 4.5.0 release (#2741) - noahtalerman: Add a new "API for contributors" documentation page (#2743) - mna: Implement async processing of hosts for label queries (#2288) - lucasmrod: Add MVP support for software inventory to osquery-perf for load testing (#2751) - lucasmrod: Fix races in go tests and run with -race on CI (#2712) - chiiph: Issue 2027 better error visibility (#2069) - RachelElysia: Add space after Resolve (#2763) - RachelElysia: Teams API: Free tier no longer calls team API throughout the app (#2766) - eashaw: add pricing question (#2759) - zwass: Fix autoformatting for fleetdm.com website source (#2775) - RachelElysia: Pass fail UI for Policies app wide (#2769) - lucasmrod: Add documentation for running live queries with GET request (#2755) - gillespi314: Fix memoization of data transform for query API results (#2790) - lucasmrod: GET packs to always return disabled field (#2799) - lucasmrod: Try

goqu

as sql builder on

listSoftwareDB

(#2773) - rlynnj11: update product.md to include Quality objectives (#2784) - gillespi314: Enhance UI for query-platform compatibility checks in new/edit query form (#2... - zwass: Update Go versions to 1.17.2 (#2805) - eashaw: Add DRI section to the Fleet handbook (#2800) - eashaw: Update adding hosts documentation (#2810) - martavis: Client side search for tables no longer debounce (#2807) - mike-j-thomas: Update customer info on DRIs table (#2811) - noahtalerman: Add top level links to "Contributing" section and move up Load testing "Resul... Read more: https://github.com/fleetdm/fleet/commits/main

Hi, when I query

SELECT * FROM es_process_events

the resulting response creates columns that are far too long! I have to scroll sideways for 7 years and one day just to get past the cmd field! Surely some wrapping could be used so that I am not side scrolling to infinity and beyond!!!!

🏗️ New commits pushed to Fleet »

I haven't been able to find any guides specific to running Fleet in Unraid. Seems like it would be pretty straight forward. I'm actually pretty new to using dockers and I've only been using Unraid for a couple of months. Here's my current docker setup. Fleet is failing here:

ts=2021-11-10T17:57:37.435547058Z mysql="could not connect to db: dial tcp 127.0.0.1:3306: connect: connection refused, sleeping 14s"

Failed to start: initializing datastore: dial tcp 127.0.0.1:3306: connect: connection refused

hi i have a question. If i host fleetdm on two VMs fronted by a load balancer, will the queries be run twice?

🏗️ New commits pushed to Fleet »

I’ve got an issue w/ running a distributed query using the 

yara

 table. If I run a basic yara rule using the 

sigrule

 column in osqueryi I get the intened results. If I run the same query via Fleet as a distributed query I get no results. The below query identifies the test file as expected in osqueryi, but nothing at all is returned via Fleet.

select * from yara where path like "/Users/scavanaugh/Desktop/%" and sigrule = 'rule hello_world {
strings:
$a = "Hello world"
condition: $a
}';

Fleet is version 3.3.0 In osqueryi paths are returned for files that have no match, in Fleet this doesn’t appear to be the case

Upgrading from 3.9 to 4.5, it looks like there is no longer a way to

Disable

users? Just

delete

them?

If this is the case, what is the function of the

status

indicator?

Is there a way to take an old json config and convert it to yaml using

fleetctl

?

🏗️ New commits pushed to Fleet »

The

Compatible with:

line in the query editor is handy thanks

Hello <!here> 👋 We've released Fleet 4.6.0 with some improvements to software/vulnerabilities, policies, and performance. Check out https://github.com/fleetdm/fleet/releases/tag/fleet-v4.6.0 for the full changelog and binaries. Containers are available on Docker Hub as usual. Please let us know if you run into any issues. 🚀

cool

Hey. Let me first raise a big thanks for the 4.6 release - the software/vulnerability feature is EXACTLY what I was waiting for thanks

Now to the problem: I have one windows machine (virtual box) that refuses to "talk" to fleet. Honestly I do not know where the error is. Fleet shows the machine (with some basic info but as "never fetched"). But I cannot run queries. This is also the same if I reset the osquery db on the machine. And even more curious I cannot delete the machine from fleet. The error of the HTTP request in chrome dev tools shows as follows:

{
  "message": "unsupported Scan, storing driver.Value type <nil> into type *time.Time",
  "errors": [
    {
      "name": "base",
      "reason": "unsupported Scan, storing driver.Value type <nil> into type *time.Time"
    }
  ]
}

Any ideas?

Can the software inventory be enabled via the config file instead of environment variable?