Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey! On what kind of interval do the policies run? Because I enabled 4 policies yesterday, and I set up a webhook to Splunk, but I don't see the policies being run again or nothing gets through to splunk?

Hi <@U01HY8L2NSU>! Policies run based on the `osquery_policy_update_interval`, set in Fleet, with the default interval being 90 min. You should only see a webhook trigger when a host is newly failing a policy.


<https://fleetdm.com/docs/deploying/configuration#osquery-policy-update-interval>

<@U02KY9FDA59> thank you for the feedback! So when I have the policy and it already ran once and tagged a few hosts as failing, and I set up the automation afterwards, then that automation won't report those already marked devices, right?

In v4.25.0, an endpoint was added to reset the status so that automations will run on all hosts rather than just newly failing:

<https://fleetdm.com/docs/using-fleet/rest-api#run-automation-for-all-failing-hosts-of-a-policy>

we deployed, using the helm chart, a little over 2 weeks ago

Hi <@U01HY8L2NSU>! OK if you have 4.30.0 then such `POST /api/v1/fleet/automations/reset` endpoint that Kathy mentioned should be available.

How to trigger such a thing:
```curl -X POST \
    -H "Authorization: Bearer $API_TOKEN" \
    <https://your-fleet-address/api/latest/fleet/automations/reset> \
    -d '{ "team_ids": [1], "policy_ids": [1, 2, 3] }'```
Where `API_TOKEN` can be retrieved in Fleet via the `top right icon` -&gt; `My account` -&gt; `Get API token` .