https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi all! It looks like using labels to target quer...
# fleet
s
Hi all! It looks like using labels to target queries with automation on, a feature introduced in 4.66.0 is supposed to be a premium feature as per the docs. However this is only enforced in the frontend and adding labels to queries using API/Gitops. The code implementing this feature (
labels_include_any
as it is called internally) is implemented in the open-source part of the codebase and not in the 
ee/
folder. Can we use the label to target query automations feature in the free tier using API/GitOps?
*adding labels to queries using API/Gitops seems to be working in the free tier
u
Hi @Smaran Jawalkar! I'm chatting with the team about this now.
👍 1
s
Hi Team! Any updates on this?
u
I'm still waiting on official word there. It seems to be a bug that it isn't gated on the API side, but I'm making sure it wasn't an intentional decision.
z
Hey @Kathy Satterlee and @Smaran Jawalkar confirming that this was a bug and will be fixed in the next sprint 🙏🏽
Thanks for reporting this!
s
Gotcha, Thank you!
Just to follow up on this, wanted to know if the packs and schedules features which are deprecated and hidden in the UI still work in the latest fleet version (
4.73.1
) and can be used?
Also just wondering, if you dont mind me asking, is @Kathy Satterlee a human or AI bot. Coz slack says they are a AI powered bot but they have human name and DP and very human sounding responses xD
😆 2
k
Hey! I'm a human. I'm Fleet's Sr Customer Support Engineer 🙂
We've got an integration that tickets conversations... I'm betting that's why Slack is calling me a bot.
And yes, packs do still work under the hood in Fleet, they're just tucked away to simplify the query/schedule workflow in the frontend.
❤️ 1
s
Hi Kathy! I am so sorry I assumed you were a bot. Thank you so much for your prompt responses and your time!
We have upstream systems that are dependent on fleetdm's packs logging format hence we are inclined to retain them for now as changes are made to said upstream systems. Any idea when fleet might decide to drop support for packs entirely?
z
It'll likely be with Fleet 5.0 (breaking change version planned for early next year)
ty 1
s
Gotcha, tysm!
b
We are testing out Fleet again (been a while since I last used it) and can't figure out how to upload query packs. Is there a writeup i can find for using the fleet UI or fleetctl to upload query packs
s
You can manage packs on the UI using the hidden webpage 
<fleet_base_url>/packs/manage
(eg: 
<https://fleetdm.mydomain.com/packs/manage>
) or you can migrate from older version to newer using fleetctl as follows: 
fleetctl get packs --yaml > packs.yaml
on older version 
fleetctl apply -f packs.yaml
on newer version
@Brandon Helms
b
ty
this worked
s
np!
11 Views
Open in Slack
PreviousNext
Powered by