Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

hey there,

has anyone found connections attempted to <http://tuf.fleetcti.com|tuf.fleetcti.com> before? is that a legitimate address from this tool?

Sounds like a place where it would find updates using <https://theupdateframework.io> (aka TUF).

And I do see references to that URL in Fleet's repo. <https://github.com/fleetdm/fleet>

Thank you, <@U041WKWUATU>!

what's curious to me is the i at the end of the word... `fleetcti` instead of `fleetctl`?

I assumed you had a typo. There is no reference to `fleetcti` only `fleetctl`

Yes, `<http://tuf.fleetctl.com|tuf.fleetctl.com>` is where we host the auto-updates.

If there really does seem to be an `i` character at the end there, that would be concerning. Please let me know if you confirm that it's an `i`, not `l`.