can someone please confirm if this puppet module is compatible with Fleetdm? https://forge.puppet.com/modules/genv/osquery/readme

Hey @Darshal Shah! Just to confirm. Are you asking about using that module as part of Fleet MDM, or just for deploying osquery?

To deploy and manage osquery. For example, if I were to put a certain query in the puppet code, will that query be uploaded into the fleetdm console?

Gotcha. In that case, with Puppet you'd just be deploying osquery and pointing it to the Fleet server. Queries themselves should flow from Fleet down to the agent. I don't see any reason that module shouldn't do the trick. Personally, for ease of deployment, I'd recommend generating a

fleetd

installer and deploying that through Puppet. That way, everything is set up to enroll the osquery agent in Fleet for you.

Thanks, will look into it! so I created the fleet-osquery custom rpm package using that command. In puppet, all of our instances that get deployed are pointed to the osquery puppet profile and automatically get lauched with that rpm package. Regarding that module, I was wondering if we can use that module to basically manage the fleetdm queries and schedule in puppet using that module rather than having to do it directly in fleetdm.

You'd need to set the osquery package you deployed up to point to Fleet. On second look, it doesn't appear that this module allows you to set osquery flags or specify a flag file, so it won't do the trick. The agent has to communicate directly with Fleet or it won't be able to enroll and data won't make its way to Fleet.

I see, makes sense

You could still use the module to install osquery but not run it as a service, then you'd need to also deploy your enroll secret and flagfile and set up osquery to run as a service manually.