did someone get a pkg file created using fleetctl package as malware ? Probably a false positive but this could cause problems in some deployment.

The docs at https://fleetdm.com/docs/deploying/configuration mention:

Fleet does not support Redis Cluster or Redis Sentinel. Fleet can scale to hundreds of thousands of devices with a single Redis instance.

yet there are config flags such as

redis​_cluster​_read​_from​_replica

Does fleet support clustered redis?

🏗️ New commits pushed to Fleet »

Hi there, I’ve noticed that in docker hub https://hub.docker.com/r/fleetdm/fleet/tags lots of strange tags have appeared. What are all those tags about? I mean the tags with random letters and digits. Usually the tags include version, but not random symbols

hi team, I'm attempting to create

msi

and

pkg

orbit packages [https://github.com/fleetdm/orbit] but i'm getting the below errors. Has anyone tried this at all or have any insight into these errors?

Is fleet vulnerable to CVE-2021-44228, the log4J 0 day?

I guess it will take some time for applications to be listed as vulnerable with the log4j exploit and show up in fleet vulnerabilities? App by app has to be checked and published by the NVD or whatever it is called right?

Or fleet will report version it sees of log4j below 2.15 as vulnerable?

fleetctl login with SSO doesn't seem to work. As I do not get any error whatsoever... 😕 No clue where do look It was working once yesterday, donno what happened. Login via Browser & SSO works w/o any problem

fleetctl config set --token <redacted> --email <redacted>
fleetctl config set --address https://<redacted>
fleetctl login
Log in using the standard Fleet credentials.
Email: (...)

Instead of being logged in directly

.fleet/config in userdir exists

root@admin:~# ls -la .fleet
total 12
drwx------  2 root root 4096 Dec 12 15:53 .
drwx------ 32 root root 4096 Dec 12 15:53 ..
-rw-------  1 root root  253 Dec 12 15:53 config
root@admin:~#

root@admin:~# cat .fleet/config 
contexts:
  default:
    address: https://<redacted>
    email: <redacted>
    rootca: ""
    tls-skip-verify: false
    token: <redacted>
    url-prefix: ""
root@admin:~#

🏗️ New commits pushed to Fleet »

Are there any hints as to where files that are carved, end up? Or is fleet not yet ready for this?

Good morning everyone! Has anyone ever tried integrating the fleet agent with Wazuh?

Hi <!here>, I'm glad to announce we've just shipped Fleet 4.7.0 🚀 We've really worked on rounding out the Policies feature, improved performance, and cleaned up bugs throughout the application. Check the changelog for full details.

Hi team I'm attempting to generate fleet packages with fleetctl using the

--flee-certificate

flag the issue I'm facing is that once I attempt to install the package on an endpoint it fails with either of the two errors below (rpm/msi). If I generate the packages with the

--insecure

flag I am able to install the packages on my endpoints successfully. Any suggestions on a direction to troubleshoot this situation?

hello and good morning I installed fleet on ubuntu version 3.5.1, I have my main server that has the MySQL DB, Redis, and the fleet service. right after I installed it I made another server with only the service on him to help the main server reduce the CPU usage and still running a simple query on 8,000 hosts won't work. I have another 2 servers with the fleet service on them but when I run a query on the 8,000 hosts I see that only the 2 first servers are being used (the CPU usage is increased). can someone help me with how to make the 2 other servers help the main and the second one with the load? thanks and have a nice day.

A question about upgrading to 4.7.0; I get the following when I did docker-compose run fleetdm fleet prepare db Missing migrations: tables=[20211116184030 20211202092042 20211202181033 20211207161856], data=[]. 2021/12/16 092334 FAIL 20211202092042_RemovePolicyHistory.go (create policy membership table: Error 1005: Can't create table

fleet

.

policy_membership

(errno: 121 "Duplicate key on write or update")), quitting migration.

I've got a situation where some Windows hosts (typically the same hosts) are frequently offline. They are registering fine, and if I restart osqueryd (5.0.1) they show online for a while but eventually go offline. I can confirm that the osqueryd process is still running on those hosts, and that they are still periodically communicating with the FleetDM server (4.6.2) on port 8080/TLS. For example, here is a tcpdump output showing the server is checking in every 15 seconds, despite showing offline in the FleetDM UI:

user@server:/usr/local/build# tcpdump -n -i ens160 -s 1514  host 10.126.3.32
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 1514 bytes
19:08:01.249229 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 668286310:668286311, ack 3209453802, win 2052, length 1: HTTP
19:08:01.249250 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
19:08:16.260289 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 0:1, ack 1, win 2052, length 1: HTTP
19:08:16.260308 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
19:08:31.269602 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 0:1, ack 1, win 2052, length 1: HTTP
19:08:31.269621 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel

I know Policies are pretty new, but is there a way to retrieve which hosts are Pass/failing a certain Policy from fleetctl ?

🏗️ New commits pushed to Fleet »

Hi, I'm trying to get fleetdm up and running. Unfortunately I don't seem to be getting software data. When I do fleetctl get config, I see "enable_software_inventory: true" - but the interface says "No installed software detected." and the software table in the database is empty. Is there anything else that I have to do, to get software data to show up? (bearbeitet)

I can't seem to install 4.7 fleet prepare db 2021/12/19 141739 FAIL 20211202092042_RemovePolicyHistory.go (create policy membership table: Error 1005: Can't create table

fleet

.

policy_membership

(errno: 121 "Duplicate key on write or update")), quitting migration. I see there's a bug report here (https://github.com/fleetdm/fleet/issues/3396) - someone said to remove indices - anyone know which ones to get an install to work?

hello can someonehelp me with how to put another server (ubuntu) behind the load balancer

This message was deleted.

I am trying to extend osquery by searching for windows event viewer event IDs ... is that possible?

Question. The host page says that there are a number of vulnerabilities on a given host, but there does not appear to be a good way of filtering the software package list to only show the vulnerable software. Is there a plan to change this?

Hey all, great improvements in the latest Fleet version 🎉🦜 I was wondering is there a way at this moment to search based on CVE? I saw that future versions might hold this feature but I was wondering if there is a workaround I can use at this moment.

I'm trying out Fleet for the first time and I've set up fleet preview but when I try to generate the installer packaged in my cmd window I'm get this result "C:\WINDOWS\system32>fleetctl package --type=msi --fleet-url=https://localhost:8412 --enroll-secret=JgHAnb5iMaSGf115aonuX8wmJPApHcBb Generating your osquery installer... 2021/12/21 124606 root pinning is not supported in Spec 1.0.19 initialize updates: failed to get orbit: move download: rename C:\Users\cramos\AppData\Local\Temp\orbit-package3642114967\root\staging\orbit.exe C\Users\cramos\AppData\Local\Temp\orbit package3642114967\root\bin\orbit\windows\stable\orbit.exe The process cannot access the file because it is being used by another process."

Hi ! I have a strange problem in fleet, could you help me with this question? The problem is that the kolide is filling the following path: /var/lib/mysql/kolide/ When checking, I notice that there are files like this one: 15G /var/lib/mysql/kolide/FTS_00000000000002ac_DELETED.ibd 12G /var/lib/mysql/kolide/FTS_000000000000002ac_00000000000003ce_INDEX_1.ibd What could be happening? Can I delete these large files without affecting the fleet DB?

🏗️ New commits pushed to Fleet: - lukeheath: Refine manage hosts page to better handle timing and loading issues (#3402) - zwass: Add fleetdm.com/jobs route (#3411) - ksatter: Add links in configuration docs (#3393) - zwass: Remove Badger DB in Orbit (#3412) - zwass: Build Orbit releases in GitHub Actions (#3413) - zwass: Update Orbit changelog for 0.0.4 release (#3415) - zwass: Update GitHub goreleaser configuration for Orbit (#3414) - zwass: Remove certificate file after import in Orbit release Action (#3416) - ksatter: Update Kafka Rest Plugin results section - mna: Update the prometheus go client library (#3140) - lukeheath: Fix loading indicator on select targets pages (#3408) - gillespi314: Fix bug in target selector UI (#3419) - RachelElysia: Update cut off icons (#3410) - chiiph: Add mdm and munki (#3406) - chiiph: Update documentation and add changes file (#3437) - chiiph: Update faq with common problem in docker (#3438) - mna: Migrate labels endpoints to new pattern (#3354) - chiiph: Finish first draft of API versions (#3216) - DominusKelvin: Fix a typo in a configuration flag (#3405) - noahtalerman: Update policy template for "Are guest users disabled on macOS devices?" (#3431) - lucasmrod: Fix policy membership migration for MariaDB (#3418) - mna: Add support for google chrome profiles (#3423) - mna: Fix metrics test by ensuring each path has a unique name (#3443) - mike-j-thomas: Add engineering section to handbook (#3442) - mike-j-thomas: Renamed Manual QA section (#3444) - mikermcneil: closes https://github.com/fleetdm/fleet/issues/3450 (#3452) - mike-j-thomas: moving DRIs table to People (#3454) - mike-j-thomas: add-page-headings-to-handbook-pages (#3448) - mike-j-thomas: Handbook - add page title to engineering (#3457) - mike-j-thomas: handbook-normalize-heading (#3459) - mike-j-thomas: Add headings styleguide to handbook (#3460) - lukeheath: Clear selected hosts on transfer (#3430) - RachelElysia: E2e policy flow (#3322) Read more: https://github.com/fleetdm/fleet/commits/main