how does fleet update software inventory ? Does it use the query created to fetch softwares or something else in backend ? If it's backend can i edit it somehow? It is fetching softwares which are not relly installed

Hey @Ojas, we are using queries to gather software inventory. It varies by platform, but we have them documented here: https://fleetdm.com/docs/using-fleet/understanding-host-vitals#software-macos https://fleetdm.com/docs/using-fleet/understanding-host-vitals#software-windows https://fleetdm.com/docs/using-fleet/understanding-host-vitals#software-linux

i am currently on 4.40

Could you share the query you're using here?

@Dale Ribeiro this is what i am using now SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs where install_location!="" UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages;

Hey @Ojas, yes the queries we're using to fetch software can be found on the Understanding host vitals page. These are the exact queries that Fleet uses to collect vitals, including twhat software is installed on a device. Is this what you're looking for? If you're not getting accurate results with software inventory, I'd recommend updating to the latest version of Fleet. Since v4.40, there have been many releases with new features and bug fixes that might fix your issue 🙂

@Dale Ribeiro gotchya thanks for that but when i try to configure agent options to override this query i get error -> Could not update settings. unsupported key provided: "features" config: options: aws_region: eu-west-2 pack_delimiter: / aws_access_key_id: ***** logger_min_status: 2 logger_min_stderr: 2 logger_tls_period: 10 aws_kinesis_stream: oss3 distributed_plugin: tls aws_firehose_stream: oss3 disable_distributed: false distributed_interval: 10 aws_secret_access_key: ****** distributed_tls_max_attempts: 3 decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: platforms: darwin: auto_table_construction: tcc_system_entries: path: /Library/Application Support/com.apple.TCC/TCC.db query: 'SELECT service, client, last_modified FROM access' columns: - service - client - last_modified command_line_flags: enable_file_events: true features: detail_query_overrides: # null disables the "users" query from running on hosts. users: null # "" disables the "disk_encryption_linux" query from running on hosts. disk_encryption_linux: "" # this replaces the hardcoded "mdm" detail query. mdm: "SELECT enrolled, server_url, installed_from_dep, payload_identifier FROM mdm;" This is what i am trying to set it to

Are you adding this configuration under agent options in the Fleet UI?

Yes