Title
#general
a

Aleks

04/27/2021, 11:44 PM
Is there a way to provide some table data at startup of osquaryd? we are a msp and want to quickly add 4 000 computer on 200 company if we can create a deployment that add some type of id of the company we deploy it on. we have a fleetdm / fleet whit multiple enroll_secrets. but need the logs coming in to add the decorators whit some company id.
zwass

zwass

04/27/2021, 11:56 PM
Some of this might be better for #fleet, but perhaps there are some general solutions that folks could help with in this channel. Do you have all the hosts from all 200 companies enrolled in the same Fleet instance?
a

Aleks

04/28/2021, 12:00 AM
not yet. if i cant diff the clitent for copany i need to create a extentions to add som ids
zwass

zwass

04/28/2021, 12:09 AM
Maybe you can do something with
--specified_identifier
and decorators?
s

seph

04/28/2021, 1:35 AM
Maybe there's somewhere you can stash data and then read it. Registry keys, plists, etc/hosts... lots of creative choices.
1:36 AM
Mostly though, I think you need to do it serverside with the enroll secrets and something. Almost anything client side seems subvertable
a

Aleks

04/28/2021, 2:59 AM
I have multiple secrets https://github.com/fleetdm/fleet/blob/12d292164f6e3414507bb98a09581ab420206f5b/docs/1-Using-Fleet/2-fleetctl-CLI.md#enroll-secrets .. but need to add some of the info into loogs. dont know if i can add any company info server side into the logs
Martin Pöhlmann

Martin Pöhlmann

04/28/2021, 6:35 AM
I was asking pretty much the same on #fleet yesterday. was also thinking about multiple enroll secrets to separate groups, but the secret name is not available in fleet via a query. https://osquery.slack.com/archives/C01DXJL16D8/p1619539373348800