Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
w
wennan.he
10/27/2022, 6:28 PMHi Fleet team, i am trying to run some APIs and filtering them by given ip, but the return list seems not expected, is there sth wrong and how to filter hosts by ip list?
k
Kathy Satterlee
10/27/2022, 6:35 PMThe
ipv4countsw
wennan.he
10/27/2022, 6:38 PMis there anyway by fleet api, fleetctl or osqueryi to query all the host by given ip lists?
k
Kathy Satterlee
10/27/2022, 7:06 PMMy original advice for that would still be what I would recommend:
https://osquery.slack.com/archives/C01DXJL16D8/p1666301340994349?thread_ts=1666296889.627119&cid=C01DXJL16D8
I understand you've run into some oddness with the ip addresses, have you had a chance to run the query @roberto sent over to verify if the upcoming fix will do the trick for you?:
https://osquery.slack.com/archives/C01DXJL16D8/p1666627014936249?thread_ts=1666304888.397699&cid=C01DXJL16D8
Just for clarity, while
ipv4/hosts/count/hostsAnd to add some context, this is essentially what is happening behind the scenes when you use the target picker in the Fleet UI.