Is there a way to provide some table data at start...
# general
a
Is there a way to provide some table data at startup of osquaryd? we are a msp and want to quickly add 4 000 computer on 200 company if we can create a deployment that add some type of id of the company we deploy it on. we have a fleetdm / fleet whit multiple enroll_secrets. but need the logs coming in to add the decorators whit some company id.
z
Some of this might be better for #fleet, but perhaps there are some general solutions that folks could help with in this channel. Do you have all the hosts from all 200 companies enrolled in the same Fleet instance?
a
not yet. if i cant diff the clitent for copany i need to create a extentions to add som ids
z
Maybe you can do something with
--specified_identifier
and decorators?
s
Maybe there's somewhere you can stash data and then read it. Registry keys, plists, etc/hosts... lots of creative choices.
Mostly though, I think you need to do it serverside with the enroll secrets and something. Almost anything client side seems subvertable
a
I have multiple secrets https://github.com/fleetdm/fleet/blob/12d292164f6e3414507bb98a09581ab420206f5b/docs/1-Using-Fleet/2-fleetctl-CLI.md#enroll-secrets .. but need to add some of the info into loogs. dont know if i can add any company info server side into the logs
m
I was asking pretty much the same on #fleet yesterday. was also thinking about multiple enroll secrets to separate groups, but the secret name is not available in fleet via a query. https://osquery.slack.com/archives/C01DXJL16D8/p1619539373348800