Title
#fleet
w

wennan.he

10/12/2022, 8:21 PM
Hi Fleet team, table app_config_json in fleet db is actually the cfg of enrolled running osquery, right? each host will read this from fleet frequently.
9:50 PM
And one more question, is there any way we can check the osquery cfg because we set

Configuration

--config_plugin=tls --config_tls_endpoint=/api/osquery/config --config_refresh=10 as flag file of osquery.
Kathy Satterlee

Kathy Satterlee

10/12/2022, 9:50 PM
That is the Fleet server configuration. The agent options are stored in
osquery_ options
. If you're not using Orbit, you'll need to set up your osquery agents to use the
tls
config plugin for them to check the config set in Fleet.
9:52 PM
It looks like you're missing the
v1
in your endpoint:
--config_plugin=tls \
 --config_tls_endpoint=/api/v1/osquery/config \
 --config_refresh=10 \
w

wennan.he

10/12/2022, 9:52 PM
is v1 required?
9:54 PM
and is v1 required for all the apis like enroll_tls_endpoint, config_tls_endpoint, distributed_tls_read_endpoint and distributed_tls_write_endpoint, logger_tls_endpoint, carver_start_endpoint and carver_continue_endpoint?
9:54 PM
@Kathy Satterlee
Kathy Satterlee

Kathy Satterlee

10/12/2022, 9:55 PM
It is.
w

wennan.he

10/12/2022, 10:06 PM
and if we want to us this api to fetch dynamic cfg of osquery, so we can modify the data in fleet db directly, right?@Kathy Satterlee
Kathy Satterlee

Kathy Satterlee

10/12/2022, 10:07 PM
I would not recommend modifying the Fleet database directly, no.
10:08 PM
You can set your agent options using the Fleet UI, the API or the CLI
10:10 PM
That’s my preferred method 😃
w

wennan.he

10/12/2022, 10:10 PM
do we have instruction showing how to change it through api or cli?
Kathy Satterlee

Kathy Satterlee

10/12/2022, 10:14 PM
Here’s a good example of an agent options Yaml: https://fleetdm.com/docs/using-fleet/configuration-files#agent-options You’d then apply that with fleetctl: https://fleetdm.com/docs/using-fleet/fleetctl-cli#fleetctl-apply
10:16 PM
And here’s info on the configuration API endpoint: https://fleetdm.com/docs/using-fleet/rest-api#fleet-configuration
w

wennan.he

10/12/2022, 10:38 PM
:ty: