Hello, Is the /packs/manage ui endpoint going away in the future? I saw the link to it went away in the schedule tab.

Hi, i just rolled out osquery / orbit to 112 devices for testing purposes on fresh fleet instance. unfortunately the host explorer shows 144 devices lots of them showing as offline. as soon as i remove those they reappear. aside from online offline status they have no host information showing and i cannot click anything to get to their details page. i am quite sure these are not real devices. no idea why they are showing up though. did i mess this up?

Hello everybody, is there a way to create fleet packages without docker?

🏗️ New commits pushed to Fleet »

What’s the update strategy for endpoint packages? I occasionally see Orbit releases in GitHub, how do we make sure our endpoints have the latest version? Do they self-update? Does

fleetctl

pull the latest version when building installers, so we have to re-build? In the web portal I only see the osquery version, not the Orbit version, so it’s always felt opaque to me.

@channel Hello! We've released a patch addressing a bug and a low severity vulnerability. Please see here for more details: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.27.1 • Fixed "Turn off MDM" button appearing on host details without Fleet MDM enabled. • Upgrade Go to 1.19.6 to remediate some low severity denial of service vulnerabilities in the standard library.

Hello everyone, the "used by" feature uses the google chrome profile to evaluate the user of the device. Are there solutions of verifying the user instead with LDAP or Open ID Connect by using an email and associated password given by the user for example while installing fleet?

🏗️ New commits pushed to Fleet »

set the channel topic: ☁️🚀 The latest version of Fleet is 4.27.1. Upgrade now: https://github.com/fleetdm/fleet/releases/latest

Hello everyone! 😄 I am having a strange issue... I already added multiple hosts to fleet (generated a installer .msi and .deb with fleetctl). Fleet can detect software on my windows hosts, but my ubuntu hosts can't detect it. Does someone have any suggestion on this?

guys i am having huge trouble deleting and updating the fleet in windows. So i developed a powershell script which deletes the whole thing because updating is throwing err on alot of machines but that powershell when run on machine directly as admin works fine and deletes the whole thing but if i push it by centralised tooling then it dosent do the job (that also has admin and install everything on machines) what do i do 😐 i am doing a clean install because many of my windows host stop reporting to fleet server and this is becoming painfull

Hello all! Could someone help me with a script or the best way to uninstall osquery-orbit on MacOs? tks for help. 🙂

🏗️ New commits pushed to Fleet »

Question about how vulnerabilities are listed in fleet. I have noticed I am getting vulnerabilities listed in fleet but the box has a updated os packages and nothing installed via a language package manager like npm or pip. My best guess is that it matching a version of package and accounting for vendor patches I just wanted to confirm this was the case or if I am missing something

set the channel topic: ☁️🚀 The latest version of Fleet is 4.28.0. More info: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.28.0 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

<!here> Fleet 4.28.0 is now available 🚢 https://fleetdm.com/releases/fleet-4.28.0

🏗️ New commits pushed to Fleet »

Hi all. In fleetv3, when Software Inventory was introduced, there was an environment variable “FLEET_BETA_SOFTWARE_INVENTORY” that could be set to true or false. in fleet v4 it's a feature in the fleet_cfg.yml file called "enable_software_inventory: true" - My question is, is there still a supported environment variable flag, like the beta version, in v4 that can still be used as a switch? While I can use "fleetctl" to modify the feature, I have a request to be able to add the feature flag like the v3 beta variable. So does this, or does this not exist in v4? The docs don't mention it. Thanks!

Hey yall. Is there a way to set an limit to the number of hosts that can connect to fleetdm?

Another question: when enrolling a host is there a seperate flag I place within the fleetctl command that allows for the package generation to include the installation of osqueryi? I think it installs osqueryd with orbit by default?

🏗️ New commits pushed to Fleet »

🏗️ New commits pushed to Fleet »

Hey folks, does anyone know what table fleet pulls the ‘used by’ email address from for a device?

Hi everyone, I have a problem when I config "command_line_flags" in Agent options in Fleet UI, the config of agents not be updated throught the configuration of "command_line_flags". I checked it by query "osquery_flags" table and received results that flag in table are not updated. What did I do wrong? Thanks.

Is this still the current source for OSQuery rule packs? https://github.com/osquery/osquery/tree/master/packs The most recent one was updated 5 months ago, and a number of these are multiple years. Quick review, they look still potentially useful, but just wondering if there is a better source for more current, actively developed packs? Thanks.

Check out https://github.com/chainguard-dev/osquery-defense-kit

Hello - Anyone know how can I retrieve history of the queries ran by a user via API. I can retrieve saved queries just fine from

/api/v1/fleet/queries

but when someone just runs a query and doesn't saves it.

Join us next week in Bellevue (Seattle)! https://fleetdm.com/announcements/seattle-bellevue-cyber-security-summit-march-8-2023

🏗️ New commits pushed to Fleet »

hm; did something break between 4.27 and 4.28? the "Hosts" view now says "something's gone wrong" and the following error: level=error ts=2023-03-05T154156.581203777Z component=http user=tor@example.com method=GET uri="/api/latest/fleet/hosts?page=0&per_page=50&device_mapping=true&order_key=display_name&order_direction=asc" took=38.047354ms err="list hosts: Error 1064: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'JSON)\n\t\t\tELSE CAST(TRUE AS JSON)\n\t\tEND,\n\t\t'name', hmdm.name\n\t) mdm_host_data\n...' at line 69"