Hi again team. When serving Fleet, I am seeing in netstat that fleet is only serving 443 over IPv6, despite my disabling IPv6 in the OS. Is there a setting I inadvertently tweaked that would have caused that?

Hi fleet team, could some help to explain this err found in redis storing with key "error{GX2ewLovVSnMWywbtDU2OCU4L5ZbSQwh7CfeSHVn2lc=}json" database error: listing hosts in pack: context canceled\"\n }

i found there are some left over data in redis after i finish some run live queries call like livequery:{16875} sqllivequery{16875} but it will be clear if i run live queries in portal, could some one explain why?

🏗️ New commits pushed to Fleet »

when i add host to fleet server i got an error "localhost.localdomain fleet[6390]: 2023/03/20 133956 http: TLS handshake error from 172.16.1.10644924 remote error: tls: bad certificate". Thanks in advance!!!

Hey everyone! I have a quick question: My hosts can check in into my fleet server (self hosted in k8s cluster), I can run scheduled queries on all my hosts

but running live queries, it keeps hanging on:

can anyone maybe help me figure out why this is happening?

Hi Team - long question here: We are planning to use this infrastructure - Client-->Cloudflare-->Elastic Load Balancer-->Fleet Server The server is named fleet.it.example.com with its own self-signed cert. The client will reach out to Cloudflare with the certificate for fleet.example.com then Cloudflare will proxy the traffic to the load balancer, which will send the traffic to the Fleet server. The question is - when generating packages for client distribution, which certificate would I use so that the client can successfully communicate with the Fleet server? Second question: Can certificate bundles be used in the package distribution?

🏗️ New commits pushed to Fleet »

Hi, fleet community. I'm new working with fleet, When I install the osquery in my Windows machines the vulnerabilities doesn't in the fleet frontend. The software list is ok, But when exist the vulnerable software the cve doesn't show in the list and the KBs microsoft doesn't list too.

Hi! I am trying to figure out how to send data from FleetDM to Elastic in order to visualize it in Kibana.

Hi team - is Okta integration possible with the community edition of Fleet?

set the channel topic: ☁️🚀 The latest version of Fleet is 4.29.0. More info: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.29.0 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

Hey <!here> happy to announce Fleet 4.29.0 is now available 🚀 Check out our release post for more 🙂

Hey guys! Sorry if this has been answered previously, but I'm trying to filter API endpoints on my WAF to only expose the ones needed by Osquery and Orbit. Looking at FAQ in the end I can see a bunch of API endpoints to whitelist, but on my WAF logs I can see that we have requests for

/api/latest/fleet/device/[DEVICE_UUID]/desktop

. This API is not documented on the FAQ and actually the UUIDs on the requests do not match any endpoint UUID on my FleetDM host list. Do you have more information on it? Thanks!

it is documented here https://fleetdm.com/docs/deploying/faq#what-api-endpoints-should-i-expose-to-the-public-internet

but really unless you're using premium you can probably block a lot of the fleet desktop/orbit functionality - it doesn't do anything useful except "my device" it seems

@Francisco Caruso about the uuid, its a unique one for the device that rolls every hour iirc

Good morning team! I'm working on Okta integration today and am running into this error: Mar 23 153519 <hostname> fleet[5941]: {"component":"http","err":"response validation failed: wrong audience:fleet","level":"error","method":"POST","took":"8.576283ms","ts":"2023-03-23T153519.891266573Z","uri":"/api/v1/fleet/sso/callback"} I saw in a previous post where this appears to be an issue with the entity ID. After looking at the metadata, it looks like the Entity ID in Fleet and the metadata are identical. Has anyone else run into this?

🏗️ New commits pushed to Fleet »

Hi fleetteam, how long the records insert into Redis when i run live query through ui/restful api will exist like "livequery:{XXX} and sqllivequery{XXX}"?

Hi team - Is there any known issue with the firefox_plugins table? I am running the query SELECT * FROM firefox_addons; on a system where it has worked previously, and it's coming back with zero results, despite verifying there are addons on the system.

🏗️ New commits pushed to Fleet »

Hey team, how do I turn off host expiry in Fleet? Do I set this value to 0?

Hi all! I'm noticing Windows hosts are taking a long time (and occasionally failing) to pull vitals, have queries run on them, etc. Mac OS and Linux are working without issue. Is there anything I need to configure to improve Windows query performance? ./fleetctl package --type=msi --fleet-url=<URL>--enroll-secret=<SECRET> —FLEET_SERVER_TLS=false --logger_plugin=filesystem,aws_firehose

Hey team, how u doing? guys, is there the fleet UI "Used by” field in fleet API? Tks for your help. 🙂

Hi All, Has anyone notice an issue with the Osquery

iptables

virtual table returning nothing ? I've dug into the source code and have a potential theory why this issues exists, but also wanted to reach out here incase anyone has seen this "gotcha".

🏗️ New commits pushed to Fleet »