Is there a way to provide some table data at startup of osquaryd? we are a msp and want to quickly add 4 000 computer on 200 company if we can create a deployment that add some type of id of the company we deploy it on. we have a fleetdm / fleet whit multiple enroll_secrets. but need the logs coming in to add the decorators whit some company id.
z
zwass
04/27/2021, 11:56 PM
Some of this might be better for #fleet, but perhaps there are some general solutions that folks could help with in this channel. Do you have all the hosts from all 200 companies enrolled in the same Fleet instance?
a
Aleks
04/28/2021, 12:00 AM
not yet. if i cant diff the clitent for copany i need to create a extentions to add som ids
z
zwass
04/28/2021, 12:09 AM
Maybe you can do something with
--specified_identifier
and decorators?
s
seph
04/28/2021, 1:35 AM
Maybe there's somewhere you can stash data and then read it. Registry keys, plists, etc/hosts... lots of creative choices.
Mostly though, I think you need to do it serverside with the enroll secrets and something. Almost anything client side seems subvertable