Hi all Is it possible to get a `Error GET api latest fleet v osquery #fleet

Hi, all. Is it possible to get a `Error: GET /api/...

11/06/2023, 5:10 PM

Hi, all. Is it possible to get a

Error: GET /api/latest/fleet/version received status 400 unknown

if I don't hold the right role to perform the task? Trying to apply a policy to a Team via the CLI and I'm a 'Maintainer'.

11/06/2023, 5:10 PM

Pretty sure my API key is all good in the config file.

11/06/2023, 5:10 PM

and my default address is set to the correct domain

Dherder

11/06/2023, 5:45 PM

You can POST to the

policies

endpoint that you are a Team Maintainer of. Can you share the command that you are running? Are you sure you have the correct TeamID?

11/06/2023, 5:50 PM

I get that error from doing things I can normally do in the GUI too like getting a list of teams

fleetctl apply -f "./fleet-policy-cis-win10.yml" --policies-team Windows

11/06/2023, 5:51 PM

TeamID is correct

Dherder

11/06/2023, 5:55 PM

Can you try this syntax:

Copy code

fleetctl apply -f ./fleet-policy-cis-win10.yml --policies-team Windows

11/06/2023, 5:56 PM

Same error 🤔 this is being run in the same directory as the yaml file too.

Dherder

11/06/2023, 5:57 PM

you probably don't need the "./" if you're in the directory already

11/06/2023, 5:58 PM

Same error. I'll try getting a new token but I'm pretty sure the config file is all good.

11/06/2023, 5:59 PM

Yeah, refreshed the API token and added

--context default

and still received the same error.

Dherder

11/06/2023, 6:05 PM

lets try from another angle (eliminate fleetctl and your yaml) by executing this curl:

Copy code

curl --location 'https://<your fleetserver>/api/v1/fleet/teams/<your team id>/policies' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <your token>' \
--data '{
  "name": "Gatekeeper enabled",
  "query": "SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;",
  "description": "Checks if gatekeeper is enabled on macOS devices",
  "resolution": "Resolution steps",
  "platform": "darwin"
}'

11/06/2023, 6:09 PM

Copy code

<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx</center>
</body>
</html>

Dherder

11/06/2023, 6:09 PM

Do you have a proxy setup?

11/06/2023, 6:10 PM

Just realised that might be the issue. I'll sort on my end, thanks!

2 Views

Open in Slack

Previous Next