Hello - I'm new to fleetDM. I'm trying to retrieve different browser history, e.g. chrome, firefox using ATC. To update the fleetDM agent, I believe I need to include these in the

config.yaml

https://fleetdm.com/docs/configuration/agent-configuration#auto-table-construction How should I test it before deploying to all machines? To deploy it, is it just running

fleetctl apply -f config.yaml

{
  "auto_table_construction": {
    "quarantine_items": {
      "query": "SELECT LSQuarantineEventIdentifier as id, LSQuarantineAgentName as agent_name, LSQuarantineAgentBundleIdentifier as agent_bundle_identifier, LSQuarantineTypeNumber as type, LSQuarantineDataURLString as data_url,LSQuarantineOriginURLString as origin_url, LSQuarantineSenderName as sender_name, LSQuarantineSenderAddress as sender_address, LSQuarantineTimeStamp as timestamp from LSQuarantineEvent",
      "path": "/Users/%/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2",
      "columns": [
        "id",
        "type",
        "agent_name",
        "agent_bundle_identifier",
        "timestamp",
        "sender_name",
        "sender_address",
        "origin_url",
        "data_url"
      ]
    },
    "chrome_browser_history": {
      "query": "SELECT urls.id id, urls.url url, urls.title title, urls.visit_count visit_count, urls.typed_count typed_count, urls.last_visit_time last_visit_time, urls.hidden hidden, visits.visit_time visit_time, visits.from_visit from_visit, visits.visit_duration visit_duration, visits.transition transition, visit_source.source source FROM urls JOIN visits ON urls.id = visits.url LEFT JOIN visit_source ON visits.id = visit_source.id",
      "path": "/Users/%/Library/Application Support/Google/Chrome/%/History",
      "columns": [
        "path",
        "id",
        "url",
        "title",
        "visit_count",
        "typed_count",
        "last_visit_time",
        "hidden",
        "visit_time",
        "visit_duration",
        "source"
      ],
      "platform": "darwin"
    },
    "chrome_login_keychain": {
      "query": "SELECT origin_url, action_url, username_value, password_element FROM logins",
      "path": "/Users/%/Library/Application Support/Google/Chrome/Default/Login Data",
      "columns": [
        "origin_url",
        "action_url",
        "username_value",
        "password_element"
      ],
      "platform": "darwin"
    },
    "firefox_browser_history": {
      "query": "SELECT id, url, rev_host as reverse_host, title, visit_count, typed, last_visit_date, url_hash, description, preview_image_url FROM moz_places ",
      "path": "/Users/%/Library/Application Support/Firefox/Profiles/%/places.sqlite",
      "columns": [
        "id",
        "url",
        "reverse_host",
        "title",
        "visit_count",
        "typed",
        "last_visit_date",
        "url_hash",
        "description",
        "preview_image_url"
      ],
      "platform": "darwin"
    },
    "brave_browser_history": {
      "query": "SELECT id, url, title, visit_count, typed_count, last_visit_time FROM urls ",
      "path": "/Users/%/Library/Application Support/BraveSoftware/Brave-Browser/Default/History",
      "columns": [
        "id",
        "url",
        "title",
        "visit_count",
        "typed_count",
        "last_visit_date"
      ],
      "platform": "darwin"
    }
  }
}

Hi @rylie! You can verify that your agent options are valid by using

fleetctl apply

with the

--dry-run

flag. This will report any error and do nothing if the configuration was valid. If you don't use the latest version of osquery, you can override validation using the

--force

flag. This will update agent options even if they are invalid. Does this help? https://fleetdm.com/docs/configuration/agent-configuration#auto-table-construction:~:text=%2D%2Ddry%2Drun,flag

Thanks @Rebecca Cowart, I had a look at this too. I also have questions do I need update ATC somewhere or that's on the config in the

overrides

section

@rylie Could you please share your config file?

I used

fleetctl get config

to get the current config and added the brave_browser_history

@rylie Are you able to get any additional information by using the

--verbose

flag while running the command?

Hi Rebecca, you're right! It was the indentation, tysm!!