Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

hey guys, I was asked if fleet can produce a report about the current state (yeah, I know document centered people and workflows, don't get me started on it). So far I have not seen such a feature, but given that fleet is likely also used in bigger orgs I though maybe someone else has built sth. using the API

What kind of report are you looking to generate?

Trying to answer that question makes me realize that the answer may be different for different people. I was thinking about sth like:
• Policy-Violation Report (e.g. Lists hosts failing a policy) the most space saving option would probably be to just list the failing hosts and only the failing policies, but  others may see that differently
• Policy Success Report: List all hosts passing all policies

The background is that we might have an auditor asking about the state of our boxes in the past. So having the ability do generate sth. like a mothly report would be great

I do realize that this is a rather big feature and will likely need considerable time.. I'm just not sure, if it is even somewhere in the backlog (didn't find a GH issue)

&gt; Policy-Violation Report (e.g. Lists hosts failing a policy)
&gt; Policy Success Report: List all hosts passing all policies
<@U034E88DWE9> currently, you can generate both of the above by first hitting the `/GET hosts` API route and then filtering the list of hosts by `issues.failing_policies_count`. Linking to this API route here: <https://fleetdm.com/docs/using-fleet/rest-api#list-hosts>

If `failing_policies_count` is greater than 0, the host fits into the “failing at least one policy” bucket.

If the count is 0, the host fits into the “passing all policies” bucket.

&gt; we might have an auditor asking about the state of our boxes in the past
Currently, Fleet only stores the current state of the device (as reported when it last talked to Fleet).

As a workaround, you could hit the API once a month to generate the monthly report.

This is an interesting use case.

I can see how a future Fleet might reduce the number of steps required to generate these reports.

<@U01DUNSE2AU> THanks. Will have to look into it. Just to clarify: For me it would not necessarily be needed to store a history. Having the ability to generate a "snaptshot report" via the Web-UI and filing that (for those document-minded people :face_with_rolling_eyes: ) would be enough