hey all! I think this may have changed recently - How does FleetDM choose which IP to display in the WebUI for a host? REF: https://github.com/Security-Onion-Solutions/securityonion/discussions/5412

It changed a few months ago. The PR description here (https://github.com/fleetdm/fleet/pull/548) indicates what we attempt to do. Could try running

select address, mac
                        from interface_details id join interface_addresses ia
                               on ia.interface = id.interface

to see what osquery picks up as far as network interfaces

Thanks Zach!