I want to store the list of queries that have been enabled f osquery #fleet

I want to store the list of queries that have been...

10/18/2021, 6:58 AM

I want to store the list of queries that have been enabled for a Fleet observer user to run in a yaml configuration file. I saw that this is controlled by the

observer_can_run

variable internally. Is this variable controllable from a yaml document? If so, could you kindly give an example of how I can use it in a yaml file?

10/18/2021, 7:50 AM

I'm guessing the answer is no. If I'm not wrong, Fleet only parses the name, description, and query fields from the incoming query spec.

Copy code

func queryFromSpec(spec *fleet.QuerySpec) *fleet.Query {
	return &fleet.Query{
		Name:        spec.Name,
		Description: spec.Description,
		Query:       spec.Query,
	}
}

https://github.com/fleetdm/fleet/blob/e2caf46d6d3a519f70300feca56c9dd303fd0293/server/service/service_queries.go#L14

10/18/2021, 8:05 AM

Raised https://github.com/fleetdm/fleet/issues/2550

Tomas Touceda

10/18/2021, 11:06 AM

hi! you are correct, thank you for filing that issue!

3 Views

Open in Slack

Previous Next