is there any timeout to fleet when I run a query that takes a long time to return reaults?

I'm curious what this group has built from a logging pipeline out of fleet to various aggregation solutions like splunk, elastic, sumo, datadog, etc? If using splunk, are you using the new Data Manager, or the splunk add-on for aws?

🤔 how do i actually create a static label for specific hostnames - which table are hostnames available in e.g. UAT group spefic hostnames (alternatively could do another enrolment key but i’m not clear if that’s supported in free fleet )?

We are looking at deploying fleet on our internal Kubernetes but would like the database on AWS RDS Aurora. Has anyone done this and if so could they share how they achieved it? We are not sure how we refer fleet to the AWS database. We can use IRSA for authentication etc but we not sure how to point fleet to the AWS DB

Hi all! I'm trying to create a link to the Fleet UI to search for a specific hostname. You can interactively search in the

Hosts

tab of the UI which updates the the

query

parameter in the URL to something like

<https://fleetdm/hosts/manage/?query=myhostname&order_key=hostname&order_direction=asc>

. But copy/pasting that URL into a new session won't filter the hosts, it only provides the full list. Is there any way to populate the

query

variable with a URL so that it searches the list of all hosts without having to type your query into the search box? That would be a super-helpful feature to pivot from other apps like Splunk. TIA!

Hello everyone, is there a way/query to check if a device is a virtual machine?

🏗️ New commits pushed to Fleet »

☁️🚀 The latest version of Fleet is 4.26.0. More info: https://fleetdm.com/releases/fleet-4.26.0 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

set the channel topic: ☁️🚀 The latest version of Fleet is 4.26.0. More info: https://github.com/fleetdm/fleet/blob/main/CHANGELOG.md#fleet-4260-jan-13-2023 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

I just started at Fleet, looking forward to working with you...

I am with another problem. LOL. sorry. From the server I am seeing this error. I do not understand what the problem is if the token is given to me by the page and it is the one that I am putting to generate the installer.

2023/01/18 15:16:59  http: TLS handshake error from 10.10.10.105:53475: local error: tls: bad record MAC

Hi Fleet team, do we have doc present how to use carve?

Hello! so reading this blog post and we are streaming events through firehose to s3 buckets, set up like your dogfood terraform. The environment variables FLEET_OSQUERY_STATUS_LOG_PLUGIN and FLEET_OSQUERY_RESULT_LOG_PLUGIN are used for the fleet server or for the osquery agents themselves? I just want to make sure my understanding is correct. Going to start testing the evented tables and I don't want to duplicate logging

Hi everyone! I just started at fleet and am excited to work with you all.

Hi fleet team, what is the formation of all the fleet/osquery api for POST? application/x-www-form-urlencoded or multipart/form-data?

Hi Fleet team, is there any expected settings for db isolation level when building a new fleet?

Hey folks, we have

logger_snapshot_event_type: true

in our config, but we're still seeing snapshot data come in as if it was set to false. Here's the options section of our config:

---
apiVersion: v1
kind: config
spec:
  agent_options:
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT computer_name AS hostname FROM system_info;
      options:
        disable_distributed: false
        disable_events: false
        distributed_interval: 10
        distributed_plugin: tls
        distributed_tls_max_attempts: 3
        enable_keyboard_events: true
        enable_mouse_events: true
        logger_snapshot_event_type: true
        logger_tls_endpoint: /api/osquery/log
        logger_tls_period: 10
        pack_delimiter: /

Is it possible I'm making a mistake somewhere, or is fleet not respecting this command line flag?

Hi, team! I have problem with Live Query in fleet. And i view some errors: Jan 20 152738 v-uib-lin-20 fleet[3733789]: {"component":"http","err":"read auth token: reading from websocket: sockjs: session not in open state","msg":"failed to read auth token","ts":"2023-01-20T122738.434424104Z"} an 20 152926 v-uib-lin-21 fleet[4025685]: {"component":"http","err":"error in query ingestion","ingestion-err":"campaign waiting for listener (please retry)","ip_addr":"my_ip:my_port","level":"error","method":"POST","took":"1.61690 Jan 20 152946 v-uib-lin-22 fleet[547314]: {"component":"http","err":"error in query ingestion","ingestion-err":"campaign stopped","ip_addr":"my_ip:my_port","level":"error","method":"POST","took":"7.431431ms","ts":"2023-01-20T12294 l Jan 18 234210 v-uib-lin-22 fleet[547314]: 2023/01/18 234210 http: TLS handshake error from my_ip:my_port tls: client offered only unsupported versions: [301] Jan 18 234219 v-uib-lin-22 fleet[547314]: 2023/01/18 234219 http: TLS handshake error from my_ip:my_port tls: first record does not look like a TLS handshake I checked, i have this settings in my nginx.conf file: proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; Can you help me to solve problem? Thanks!

🏗️ New commits pushed to Fleet »

Hi Fleet team, is that the rest api the only way to create team?

Hello - where are the error logs for FleetDM? I am attempting to troubleshoot a connectivity issue between a newly enrolled osquery agent and the FleetDM server.

Hello - one more question: I've installed the agent on a Mac OS system, and I am seeing this error on the server side - "Host 1 was not found in the database" - This is the first agent I've attempted to join to FleetDM. Not sure what this error is, or what's causing it.

how do I control what osquery version will orbit deploy?

🏗️ New commits pushed to Fleet »

The cert download from fleet and config in the osquery is the server cert or client cert?

Hi Team, can queries be run using the Last fetched & Last seen values. I'd like to create a automated policy that reports devices that have not checked-in for a given number of days...

hi all, I'm working on a self-hosted deployment of Fleet on AWS ECS. I've got everything up and running, but I'm having issues with running

fleetctl

from my local machine to generate an install package. any subcommand of

fleetctl

I try just seems to hang forever. I've tried both the release from the GitHub releases page and installing via

npm

. I've also tried with and without

sudo

. I'm on macOS 12.6 (Intel hardware). any idea what might be causing this?

https://osquery.slack.com/archives/C01DXJL16D8/p1674596223491939?thread_ts=1673990590.837659&cid=C01DXJL16D8 any help please?

Getting the following on our drone pipeline when trying to deploy fleet on Kubernetes. We have tried

chart:fleet/fleet

and

chart:fleet

Any ideas as to why the helm chart is not being found?

2023/01/27 12:11:44 No v3 Release of fleet found
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /root/.kube/config
WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /root/.kube/config
"fleet" has been added to your repositories
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /root/.kube/config
WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /root/.kube/config
Error: could not find fleet: stat fleet: no such file or directory
while executing *run.DepUpdate step: exit status 1