Title
#fleet
defensivedepth

defensivedepth

09/07/2021, 3:52 PM
hey all! I think this may have changed recently - How does FleetDM choose which IP to display in the WebUI for a host? REF: https://github.com/Security-Onion-Solutions/securityonion/discussions/5412
zwass

zwass

09/08/2021, 3:44 PM
It changed a few months ago. The PR description here (https://github.com/fleetdm/fleet/pull/548) indicates what we attempt to do. Could try running
select address, mac
                        from interface_details id join interface_addresses ia
                               on ia.interface = id.interface
to see what osquery picks up as far as network interfaces
defensivedepth

defensivedepth

09/09/2021, 8:49 PM
Thanks Zach!