osquery #fleet

JD Strong

04/12/2023, 6:45 PM

Who wants to try out Fleet's GitOps workflow and win a prize? https://github.com/spokanemac/fleet-capture-the-flag

Zachary

04/12/2023, 7:48 PM

hey folks just curious got fleet running locally and was able to get my device enrolled. I'd love a live query feature much like osqueryi...is it possible to install osqueryi after I enroll without breaking anything?

Hello_There

04/12/2023, 8:39 PM

hi folks ! I have a problem that I would like your opinion to solve, recently my fleetdm 4.12 self-signed certificate has expired. In this case all hosts stopped communicating, now I understand that it is necessary to generate a new one. I have a doubt after generating the certificate do I also have to generate a new MSI package? And reinstall on all hosts again? Because when I installed the agent on the Windows hosts I generated an msi package: fleetctl package --type=msi --fleet-url=https://192.168.0.30:8080 --enroll-secret=tstesttestetets H --fleet-certificate=/etc/ssl/certs/server.cert

Hello_There

04/12/2023, 8:43 PM

Or else I can renew the certificate? Without having to generate a new msi package?

Mike S.

04/12/2023, 9:58 PM

Hi all! Hoping you can assist with a Windows agent issue: While looking into an issue with Windows hosts intermittently pulling vitals and not returning live query results, I found an error after installing the Fleet Windows agent on Win10/11/Server 2019: INF Service Stop Requested 2023-04-10T184945Z ERR unexpected exit error="os service stop request" It looks like this is occurring every 25-30 minutes. The package was generated on a Linux system (working on getting a Windows system to test package generation) with these flags: fleetctl package --type=msi --fleet-url=<URL> -enroll-secret=<SECRET> —FLEET_SERVER_TLS=false --logger_plugin=filesystem,aws_firehose --verbose=true --debug=true Let me know what other info I can provide!

Luke Heath

04/12/2023, 10:15 PM

set the channel topic: ☁️🚀 The latest version of Fleet is 4.30.1. More info: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.30.1 Upgrade now: https://github.com/fleetdm/fleet/releases/latest

Vlad Previn

04/13/2023, 5:19 AM

👋 is there a feature flag to disable fleet mdm related UI features/and services (and to keep it disabled once it’s fully out). context: planning to upgrade from 4.27 to 4.30.1 not super clear what the situation with fleet mdm is (not going to try it either and want to avoid any issues or bugs or resource use that might arise from aciddentally enabling or clicking the wrong thing via a config flag)

JD Strong

04/13/2023, 4:00 PM

Check out Fleet's GitOps workflow and win a prize! 🚩 We're spinning this back up for a few hours, so get those PRs in. For those with existing PRs, we'll be approving those shortly. https://github.com/spokanemac/fleet-capture-the-flag

Glen

04/13/2023, 5:00 PM

Question: The new mdm features, are they available for windows machines yet? The documentation only refers to MacOS from what I see so far. If they’re not live yet, is there any rough ETA on windows support?

Jason Roberts

04/13/2023, 6:32 PM

Hello, I just tried to upgrade to 4.30.1 and ran into the error # Missing migrations: tables=[20230315104937 20230317173844 20230320133602 20230330100011 20230330134823 20230405232025 20230408084104], data=[]. 2023/04/13 182519 FAIL 20230315104937_EnsureUniformCollation.go (fixing software table: aggregating dupes: Error 1253: COLLATION 'utf8mb4_unicode_ci' is not valid for CHARACTER SET 'utf8'), quitting migration. Running Database version is MySQL 8.0.18 in GCP CloudSql From version": "4.28.1

Mike S.

04/14/2023, 7:51 PM

Hi Team - have you seen any previous issues where a Windows Fleet Agent is being blocked/flagged by Cloudflare as "Command injection - Common Attack Commands"? This does not appear to be a rule we have written, but an automatic CF detection. Agent package creation was done only with --fleet-url and --enroll-secret. The issue is not being seen on Mac or Linux agents.

Shiji Zhou

04/15/2023, 12:48 AM

Hi Guys, I have a question about the fleet source codes (probably a bug but not sure), is here a correct place to ask?

Shiji Zhou

04/15/2023, 2:29 AM

@Kathy Satterlee Thanks. In the

LabelQueriesForHost

method in

server/datastore/mysql/labels.go

, there is a SQL query to get label queries for given host :

Copy code

query := `SELECT id, query FROM labels WHERE platform = ? OR platform = '' AND label_membership_type = ?`
	rows, err = ds.reader.QueryContext(ctx, query, platform, fleet.LabelMembershipTypeDynamic)

Considering that MySQL

AND

operator takes precedence over the

OR

operator, the query is the same as:

Copy code

SELECT id, query FROM labels WHERE platform = ? OR (platform = '' AND label_membership_type = ?);

With this statement, a label query will be returned if the host's platform matches label's platform, even if the label's label_membership_type is
"manual"
instead of
"dynamic"
. However, a "manual" label is populated manually without the execution of a label query, so it is meaningless to return label queries for a manual label. Then I would suppose the query should look like:

Copy code

`SELECT id, query FROM labels WHERE (platform = ? OR platform = '') AND label_membership_type = ?`

Which instead means that it only gets

dynamic

label queries if the label's platform matches the host's or the label's platform is "all platforms" I really appreciate it if someone could correct my misunderstandings, or confirm that there are some problems here.🤝

Zapier

04/17/2023, 5:39 PM

🏗️ New commits pushed to Fleet »

Thiago Cruz

04/17/2023, 10:04 PM

Hi, I'm setting up FleetDM (v4.30.1) with a NGINX (v1.20.1) on Oracle Linux 9:

Copy code

[windows with Orbit] --(https)--> [NGINX] --(proxy_pass)--> [FleetDM]

Everything is working fine, but I'm receiving this error message:

Copy code

==> /var/log/nginx/fleet_ssl_error.log <==
2023/04/17 18:56:11 [crit] 206522#206522: *850 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: 192.168.0.33, server: 0.0.0.0:443

Should be expected a EOF from Orbit or is there some misconfiguration?

Jesse Mundis

04/18/2023, 12:16 AM

Hi all. I’m looking to find any information regarding the assigned DNS servers to a client’s network adapter. I would be looking for the IPs of DNS servers assigned to physical adapter(s) on each host. I don’t need to look up DNS events. I just want to collect any/all DNS servers per machine per adapter. I tried dumping the table “dns_resolvers” but that doesn’t seem to break it down by network adapter. Is this data available in osquery/fleet somewhere else I’m missing? Thanks

Jincheng Yin

04/18/2023, 9:37 AM

Hi team, we are seeing the DB increased 1GB last month. Will the size of DB keep growing?

Ojas

04/18/2023, 10:29 AM

while creating the agent can we change the path of the folder osquery is installed to? i am using fleetctl. When pushing new agent it fails and most likely error is that it sees the older folder is there and it is not able to replace it. So how do i change the path to different one like orbit2 or something

James Konderla

04/18/2023, 5:01 PM

Hello! First time here but I couldn't find the answer in the documentation, online or in the SecurityOnion forums. I am trying to apply the Fleet.config file after enabling the software inventory feature but I am getting the error "Error: applying fleet config: PATCH /api/latest/fleet/config received status 422 Validation Failed: missing or invalid license". This is a self-hosted Fleet instance on a security onion VM (fleet itself is inside of a docker container).

Jason Lewis

04/18/2023, 5:42 PM

Hello Fleet community! 👋 My name is Jason Lewis and I've just joined up with fleet where I'll be operating as a Senior CSM. I look forward to collaborating with you all in the future.

Nemanja

04/19/2023, 7:06 AM

Hello everyone. Is it possible to write a query in FleetDM to obtain vulnerabilities? I cannot find in which table this information is located. Thank you for your help.

Vlad Previn

04/19/2023, 11:46 AM

qq is gitops role in 4.30.1?

Arsenio

04/19/2023, 3:28 PM

Does json_extract work with queries? I am trying to pull Vscode extension and each extension directory has a package.json file that contains metadata about each extension. so i was trying to pull a few keys out of it to create a list. what i have so far but get a

*Compatible with:Estimated compatiblity based onthe tables used in the query.*No platforms (check your query for a possible syntax error)

Copy code

SELECT
    path
    json_extract(path, '$.displayName') as displayName,
  FROM
    file
  WHERE
    path LIKE '%/%/.vscode/extensions/%/package.json'
    AND type = 'regular';

Federico Alliani

04/20/2023, 6:39 PM

Hello, how are you? A few days ago we deployed Fleet on Kubernetes with the Helm chart, and now we wanted to configure the MDM for Apple devices. We saw the documentation that requires setting some environment variables. Is there a way to set these environment variables? If not, do you think this PR could solve it?

Keith Swagler

04/20/2023, 6:56 PM

Hi everyone, we are trying to setup Apple MDM but we are running into some trouble receiving the email with the CSR from support@fleetdm.com. Does that email go through Fleet's SMTP servers? Is there a person that needs to approve these ?

wennan.he

04/20/2023, 11:55 PM

the live query i am running in the page breaks every time in the middle, is there any well known issue will cause that?

Younes Boulfred

04/21/2023, 12:37 PM

Hi, the fleet MDM is only available for MacOS ?

Arsenio

04/21/2023, 2:31 PM

Hello, just to verify if we use the host expiry window, that only deletes the host out of fleet correct? it doesn't stop the orbit service or stop it from connecting back if it comes back online

frederick ferby

04/21/2023, 3:31 PM

Hello, Trying to see Observer+ and Gitops as user permissions, but unable to see them. - Is there anything I have to enable in fleetdm see the extra perms?

Zapier

04/22/2023, 3:25 PM

🏗️ New commits pushed to Fleet »