Hello, I use the Fleet Kolide 3.1 with osquery V4....
# general
h
Hello, I use the Fleet Kolide 3.1 with osquery V4.5.0-1, in the osquery.conf configuration I changed the decorators example : "decorators": { "load": [ "SELECT cpu_type AS arch FROM system_info;", "SELECT uuid AS host_uuid FROM system_info;", . "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;", ] }, but in the fleet logs osquery_result doesn't change it uses the default decorators, Is in Osquery 4.5.0-1 the code to change for decorators management ?
z
If you are managing configuration via Fleet then you need to manage the decorators there. The osquery.conf will be ignored/overwritten by values from Fleet.
h
Thank you, is it possible to make a specific tag per machine (host)?
z
What do you mean by tag?
h
for example you have 6 machines : 03 machines they are in an asset A 03 machines are in asset B I just want to add on the 03 machines the tag=asset_A and for the other machines tag=asset_B in the decorators of the machine With this tag it's easy to do the investigation by asset the problem with the decorators configuration on the kolide fleet is that it is applied on all the machines concerning it is not possible to specify per machine "decorators": {     "load": [        "'asset_A' AS tag", "SELECT cpu_type AS arch FROM system_info;",       "SELECT uuid AS host_uuid FROM system_info;", .       "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;",     ]   },