Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello, It is possible to use Discord Webhooks for Policies Automations?

Hi <@U01BCJ2K7T3>! You can configure any destination for the <https://fleetdm.com/docs/using-fleet/configuration-files#failing-policies-webhook|failing_policies_webhook>. Depending on how Discord needs request formatted, you may need to use a middleman (I like <https://www.tines.com/|Tines>) to actually receive the request, do whatever formatting needs to be done, and forward it on to its final destination.

Hello! I've configured the automations via the "Manage automations" button in the Fleet GUI. I've directly pasted the Discord Webhook but aparently it's not enough

Quick question, what is the timer for sending the policy webhook?

The policy webhook is sent based on your <https://fleetdm.com/docs/deploying/configuration#osquery-policy-update-interval|policy update interval>.

I did a quick bit of research into Discord webhooks and it looks like there are likely required fields that wouldn't be included on the Fleet side. In that case, you'd need to go the route of sending the webhook somewhere where you could tweak the payload to have required fields/headers and then forward to Discord from there.

Great! So the invertal means then the policy fails the Webhook is sent?

Yeah, I though so about the required fields for Discord

Yes, when policies are processed on the Fleet side, that triggers the webhook for any newly failing hosts.

Great, so I can configure my webhook via the interface

Well, I configured the webhook using n8n and setting up the interval with the env variable but it's not sending anything

Try hitting the refresh endpoint to make sure that all failing hosts read as new:

<https://fleetdm.com/docs/using-fleet/rest-api#run-automation-for-all-failing-hosts-of-a-policy>

And remember that it may take some time for the webhook to trigger.

All of this assuming that you currently have at least one host that's failing a policy :slightly_smiling_face:

You can also force a run with `fleetctl trigger --name automations`

Mmmm, I received my request on my server but the webhook didnt trigger

Okay, weird. That command with the debug options  shows
"interval": "24h0m0s"

My webhook server is using a self-signed certificate. Maybe is because of that?

Well, hitting the refresh and running the trigger command didnt work

The webhook for % of offline hosts did work but policies not