anyone could help https://osquery.slack.com/archives/C01DXJL16D8/p1665785858029499?

Hi fleet team, does fleet support sentinel feature for redis? i mean if there is switch of redis master node, could fleet switch redis-server automatically also?

What are the main differences between fleetdm and https://www.elastic.co/guide/en/fleet/current/fleet-overview.html ??

I.e. Fleet vs Fleet

In full disclosure, the use case I'm trying to get at was around the capability to issue mass live queries around all my devices in the case where some threat actor could have compromised a group of internal employees. If I issue a bunch of commands right now, what confidence do I have that they will be executed EVER and how do I report on that?

Thoughts?

Out of curiosity, is there a way to force osquery to check in with Fleet?

Hey, is it possible to make all of the used queries and policies transparent to all employees having fleet installed on their systems?

I have a Kubernetes cluster that runs many instances of the fleet, and I want to make my fleet logs as a filesystem plugin, and I wanted to ask if it's possible that all the pods will write to the same pvc?

Am looking for a way to enable process_file_events table in Linux environment, I was able to enable file_events using command line osquery.flags. Osquery is configured via fleetdm i have below config to enable process_file_events in osquery.flags --disable_events=false --disable_audit=false --enable_file_events=true --audit_allow_config=true --audit_allow_fim_events=true --audit_allow_process_events=true --audit_persist=true can you give me points what am i missing

Hello, We use Fleet Free with no license. starting today, we have a tons of logs :

GET /api/latest/fleet/device/<id>/policies

resulting to error from Fleet :

Requires Fleet Premium license

Several occurences by day (~7K), not a problem until today and we are at this moment above 5 M! Fleet server is under a big load (we mitigate by adding a 404 redirection on nginx conf). We do not change anything on Fleet server side (version

4.20.0

), and on client side we use Fleet-Desktop with updates enabled. We see that osquery 5.6.0 has been released but only 2 clients have been updated over ~200. We don't understand how and why it happens since today (tons of requests starts at 00h). Do you have any information or things we can check ?

Hi fleet team, does fleet support query running on a given ip list?

Hi fleet team, may i know where does fleet fetch the private ip? i found we have a lot of hosts with same private ip, i doubt fleet does take loopback ip as private ip, could u confirm?

Hi fleet team, our host running osquery without orbit has a lot logging like Oct 21 180013 n121-016-058 osqueryd[2364927]: E1021 180013.021610 2365073 distributed.cpp:145] Error executing distributed query: fleet_detail_query_orbit_info: no such table: orbit_info is there anyway to stop osquery running this query?

Is the initial help docs for installing FleetDM on CentOS absolutely out of date or did a whole lot just recently change throwing things off? I didn't have a single portion of the install "guide" register correctly - either files are missing/upgraded/gone - replaced by another service - etc... I got further in my install on ubuntu than the official CentOS install guide... am I missing something? https://fleetdm.com/docs/deploying/server-installation

Hello fleet community, hope everyone is doing well 👋🏽 . I’m wondering how to fully remove the fleet-desktop app from a macOS. I removed everything related to osquery and fleet. On the paths where this doc refers and other places. But after reboot the fleet desktop agent in the navbar still appearing and is stuck in connecting. Just for context, I tried the sandbox account for investigation proposes. Thanks in advance 🙏🏽

Hello fleet community, I did a fleet upgrade 3 weeks ago (from version 4.6.1 to 4.20.1) and am experiencing a lot of OOM since. I will attach some stderr logs in the thread. I tried to add memory, to bump to 4.22.0 and still facing the issue. Is anyone having the same behavior? Few things about config : • 30 fleet instances with 8GB RAM each, running behind LB (haproxy) • DB is MariaDB (I know it is not officially supported) • Managing ~40k servers (mostly Linux with few Windows) using osquery from 4.6 to last version • Software Inventory is disabled

hey, what could be the cause of this occurring on most hosts?

{"component":"http","err":": Authentication required","internal":"authentication error: invalid orbit node key","level":"info","path":"/api/fleet/orbit/config"

Hey fleet team 👋 I am trying fleet-desktop on a macOS device. The app is stuck on connecting, so I used the cleanup script and reinstalled everything, but it is still not working. Here is the error after the installation:

/opt/orbit/bin/desktop/macos/stable/Fleet\ <http://Desktop.app/Contents/MacOS/fleet-desktop|Desktop.app/Contents/MacOS/fleet-desktop> 
2022-10-25T15:44:51+02:00 INF fleet-desktop version=1.3.1
2022-10-25T15:44:51+02:00 FTL missing URL environment FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH

Any idea on why I am having this issue? Thanks in advance.

Hello everyone! I'm having a little problem regarding OSQuery for MacOS: some hosts keep "rejoining" Fleet with different hostnames (sometimes even with the same hostname) and I have no idea why. Note in the screenshot that it is the same machine, based on the serial number

Hello everyone, has anyone else experiences that in updating to macOS 13.0 the file:

/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist

disappears? We've seen this on a handful of systems, and it appears to be a temporary situation, curious to know if anyone else has observed a similar issue with the upgrade to macOS 13 ?

Hi Fleet team, could u tell me how does fleet fetch the version of osquery, i have a osquery pkg built by myself following the standard Debian requirement. and fleet telling that with some weird content as showing below.

Hi Fleet team, i am trying to run some APIs and filtering them by given ip, but the return list seems not expected, is there sth wrong and how to filter hosts by ip list?

Any plans for the

curl

table to support sending request bodies? https://fleetdm.com/tables/curl

Hey <!here>, earlier this week we released Fleet 4.22 🎉 (Note there is also now a 4.22.1 that fixes a Fleet Desktop issue for Fleet Free users. Fleet Premium users, or those not using Fleet Desktop will not need this patch) For Fleet Premium: We added aggregate information about missing hosts and hosts with low disk space on the home dashboard. For all versions: We improved the sidebar in the query page with examples for many of the tables in osquery, along with making more clear host display names. For more details, check out https://fleetdm.com/releases/fleet-4.22.0

Hello I upgraded from 4.20.1 to 4.22.1 and it says:

I click the link to the documentation, it takes me to the features section and I note that it says features.enabled_host_users defaults to true so it should be on as I haven’t specified it right? Anyway I now specified it as true and nothing changes.

I also note that my queries which used to contain TargetUsername for event log 4625 no longer contain any username, I suspect it is related to this?

So documentation says it should be on by default but as you can see it itsn’t and I can’t find any way to enable it.

Also someone broke the favicon it’s way too big now

Should we expect a new release or docker image rebuild for when the OpenSSL CVE/patch lands tomorrow?