Hi Team! What would be the best way to add an existing osquery installation to Fleet?

Hello! Here's what's new in Fleet 4.27.0: • AUDIT TRAIL FEATURE: See failed login attempts to Fleet in the activity feed as an added layer of security to understand if an account may be compromised. • Better search filters on the 'Select targets' page • UI bug fixes More info: https://github.com/fleetdm/fleet/blob/main/CHANGELOG.md#fleet-4270-feb-3-2023 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

<!here> ^

Hi all - per my discussion with @roberto, I'm moving this convo back into the fleet channel for visibility. The issue is related to the error "Request error: certificate verify failed" - I'll put the details in the replies so it doesn't have a wall of text in here. 🙂

Hello! Enabled audit logging on Fleet version 4.26. We are using firehose to send to an S3 bucket. The permissions we have for the audit logs are identical to the status and results logs that work and we are getting logs for. I enabled audit logging and the audit log plugin set it to firehose but not getting anything. I tried logging in and I see other activities to generate data. No, terraform errors either. Are there any other environment variables that would need to be set?

Hi Team - I saw some mention of this in the comment history but wanted to try to get some clarity - I noticed when attempting a Windows MSI install today that there were Docker errors. We installed Docker and this resolved the issue, but why is Docker required for this installation to work properly?

Hello. all new to fleet/osquery. so i was wondering about how to create the installer for windows endpoint. windows doesnt let me use fleetctl on windows. in the fleetdm interface it has this "Add Host" button. and pops up with a window where it gives this command to execute. but i cant get it to work, secret and fleet-url is correct. but main problem would get to actually execute the fleetctl command. anyone that can help ? maybe iv'e missunderstood the method of generating this msi ?

Hello team! I just upgraded from version 4.26 to 4.27 and so far everything is running fine, thanks for the great work! However, I have a small problem: I can no longer view my query packs previously created via the dashboard because the Schedule page no longer has the

advanced

button, I can only consult them through fleetctl. Should I migrate them to the new scheduled queries format?

🏗️ New commits pushed to Fleet »

Good morning! Someone on my team pointed out that when you are on the hosts page and click next, it goes to the next page but then reloads and goes back to the first page. Is this a known bug? Version 4.26

hello! is there a way to pull nvidia geforce drivers? i can see the display drivers but not what we need atm

Does anyone know the easiest way to expose the fleet server correctly on an EC2 instance? Following these (https://fleetdm.com/docs/deploying/server-installation#running-the-fleet-server) directions, how could I pass the Fleet webserver the public ipv4 address of the ec2 instance? I have fed the FQDN of the instance to the startup command, but I need to expose the setup interface on the public ec2 url, not localhost. I could be overlooking something obvious. I am assuming no interference from SGs or NACLs. Don't need it in a VPC, don't need a NAT device. Is there a way to do that?

👋 ive been having a chronic issue for a while with the software page in self-hosted fleet. it will never load completely and our RDS instance will run up to 100% cpu usage. i recently upgraded the instance from

db.t3.medium

to

db.t4g.large

and still seeing performance issues. i temporarily bumped it up to a

db.r5.xlarge

and while the cpu didnt max out, the page still spun. we only have less than 300 hosts, so i am not sure how complex this query that is running is. any ideas on how to trace down what is causing the slowness and how to address?

This message was deleted.

hey i dont see policies tab in fleet desktop:

Hey Team, Also just checked that when a fleet desktop window opens that token is active for an hours by default but if you just copy that url and browse it from someother device as well you are able to see all the details. Thats kinda spooky so if someone gets hang of url they can checkout all the details. any way to fix this please?

Has anybody seen this error in osquery logs before? The osuqery and fleet config looks ok, but I am seeing this error coming up periodically

I0208 17:44:39.302111 254910464 buffered.cpp:75] Error sending results to logger: Cannot parse JSON: The document root must not be followed by other values. Offset: 4

🏗️ New commits pushed to Fleet »

Hi team - I believe I am confused regarding the command_line_flags portion of the Agent Options configuration in Fleet. What can be added to that portion that's different from the standard config options? I've tried adding things like

config_refresh: 0

but I get an error indicating that this is an "unsupported key".

quick question, is there a way to specify a password (ideally a FLEET_SERVER var) to unlock a tls private key for the fleet server? couldnt see anything in the docs about it

is there a good place to see the current state of "what parts of the api/app the agent/frontend/user needs to access" and splitting that out from the rest of the api, webui etc. Found a couple of blogs but they're old, and I've implemented what I think works in an nginx proxy but it feels kind of janky

Hi all - looking further into Agent Options today - is there an option in which to customize the command_line_flags per operating system? For example, we'd have to configure a different

--flagfile

location for Windows/Nix operating systems.

#fleet I think I have found a defect in Feet version 4.22.1, where hosts associated with a disabled pack can still get the queries in the disabled packs and schedule them to run. I see the issue only with the host association, not labels.

Hi Fleet team, is serial number present in portal for compute?

Hi Fleet team, is there anyway to let UI terminate the live query stuck and present the outcome even there is no response from small portion of hosts?

Hi fleet team, we found out we miss a small portion of our hosts in fleet, maybe could u help to explain what is the possible reason can make it happened?

hi fleet team, is there any way to schedule the policy and run it on whole sets?

we have some err in our redis like "error{GRvqZSU6Xr9wn9NgM1ifyxwQ8DvEqiZkW7a6oWuQgGQ=}json" and i got the val of it: "[\n {\n \"message\": \"Authentication required\"\n },\n {\n \"message\": \"missing FleetError in chain\",\n \"data\": {\n \"timestamp\": \"2023-02-10T225214Z\"\n },\n \"stack\": [\n \"github.com/fleetdm/fleet/v4/server/contexts/ctxerr.Handle (ctxerr.go:258)\",\n \"github.com/fleetdm/fleet/v4/server/service.encodeError (transport_error.go:80)\",\n \"github.com/go-kit/kit/transport/http.Server.ServeHTTP (server.go:124)\",\n \"github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerRequestSize.func2 (instrument_server.go:204)\",\n \"net/http.HandlerFunc.ServeHTTP (server.go:2109)\",\n \"github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1 (instrument_server.go:239)\",\n \"net/http.HandlerFunc.ServeHTTP (server.go:2109)\",\n \"github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1 (instrument_server.go:117)\",\n \"net/http.HandlerFunc.ServeHTTP (server.go:2109)\",\n \"github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func2 (instrument_server.go:84)\",\n \"net/http.HandlerFunc.ServeHTTP (server.go:2109)\"\n ]\n }\n]" but we didn't install prometheus, why it has this err?

Hello everyone, is there any possible way/configuration to know which device is owned by which employee in a fleet production env?

Does fleet intending on getting SOC2 Type II certified and if so, what are the timelines?