Is it possible to receive data from Osquery via Fleet without direct binding to hosts? For example, in the form of statistics. I would like to get a list of usernames with the number of each on the servers. For example:

username, count
root, 10
test, 5
mysql 3
redis 1

Hi @Artem! Two questions: 1. What do you mean by "direct binding to hosts". 2. Re your example: are looking into aggregating results from live queries returned by hosts?

@Lucas Rodriguez I mean that currently all osquery results via FleetDM always related to specific hosts. I can not get aggregated results globally.

Currently, such aggregation is not possible. However we happen to be working on something similar: #5655 (basically allows

fleetctl query

to aggregate results from hosts by using

sqlite

on memory). Is this something that would help your use case?

@Lucas Rodriguez thank you for answer!