https://github.com/osquery/osquery logo
Title
k

Keith Swagler

12/17/2021, 3:37 PM
I know Policies are pretty new, but is there a way to retrieve which hosts are Pass/failing a certain Policy from fleetctl ?
l

Lucas Rodriguez

12/17/2021, 3:45 PM
Hi Keith! I will check with the team but I don't think we have such functionality exposed in
fleetctl
. On a related note: We are currently working on "policy automations", to configure webhooks when fleet detects hosts are failing configured policies.
I got the following from the team:
fleetctl get hosts --yaml
 returns issues with a count of how many failing policies, but nothing more detailed than that
z

zwass

12/17/2021, 5:40 PM
(The info is available via the API though, use the List Hosts endpoint with the
policy_id
and
policy_response
filters.)
l

Lucas Rodriguez

12/17/2021, 7:25 PM
After some testing we actually found it's possible 🙂
fleetctl get hosts $hostname
This will list all the information of a host, including the list of passing and failing policies.
k

Keith Swagler

12/17/2021, 8:41 PM
Awesome thanks guys !