https://github.com/osquery/osquery logo
Powered by
#fleet
Title
# fleet
k

KK

10/18/2021, 6:58 AM
I want to store the list of queries that have been enabled for a Fleet observer user to run in a yaml configuration file. I saw that this is controlled by the 
observer_can_run
variable internally. Is this variable controllable from a yaml document? If so, could you kindly give an example of how I can use it in a yaml file?
I'm guessing the answer is no. If I'm not wrong, Fleet only parses the name, description, and query fields from the incoming query spec.
Copy code
func queryFromSpec(spec *fleet.QuerySpec) *fleet.Query {
	return &fleet.Query{
		Name:        spec.Name,
		Description: spec.Description,
		Query:       spec.Query,
	}
}
https://github.com/fleetdm/fleet/blob/e2caf46d6d3a519f70300feca56c9dd303fd0293/server/service/service_queries.go#L14
t

Tomas Touceda

10/18/2021, 11:06 AM
hi! you are correct, thank you for filing that issue!
3 Views
Powered by