Does

fleetctl package

when run always packages the latest osquery from the internet?

hi there, fleetctl package technically only builds an installer for Orbit (and potentially Fleet Desktop), osquery is downloaded from our autoupdate server. The version of osquery hosted there depends on what we have pushed. We try to always have the latest, but that's not always the case

@Tomas Touceda Hi, does that mean the endpoints need to have internet connectivity even to get osquery installed (and also for updates)?

correct. You could alternatively host your own autoupdates server (premium feature)

Got it. I always assumed hosting the server was not required atleast to get osquery (any version) for non-internet accessible systems.

you could disable auto updates and install osquery with a similar approach as you install orbit

That's not quite right. The system that builds the package needs internet access, but the system that installs the package does not. If there's no internet access there will be no updates, but it should still install and function properly. You can also just disable autoupdates.

ah! thank you Zach for correcting me, TIL

So, to conclude, the

fleetctl package

command will contact fleetdm's server and get mostly the latest osquery from there and we can distribute it to local network? (context: I am trying to use the mentioned command every quarter to generate latest osquery to push to our local network)

Yes, that's right.