Ahmed
06/29/2021, 2:27 PMorbit
documentations but i couldn’t find. keeping osquery updated started to be a pain, and i wanted to test orbit
which is really promising.
is there any doc that get me started?
how can i make the source of binaries to be internal rpm repo?
because not all machines will reach out to internet, so i would need to host orbit, and osquery packages internally and install orbit for the first time and keep it in sync with the internal repo for any new packages.Noah Talerman
06/29/2021, 2:50 PMAhmed
06/29/2021, 2:51 PMorbit
download a package that you need to install?
i tested with this command which generated an osquery package
sudo ./orbit-package --type rpm --osqueryd-channel edge --fleet-url <https://fleet.internal.com:443> --enroll-secret $(cat /etc/osquery/osquery_enroll_secret) --fleet-certificate=/etc/osquery/fleet_cert.pem -- --flagfile=/etc/osquery/osquery.flags
output
2021-06-29T11:42:08-04:00 INF wrote package path=orbit-osquery-0.0.2.x86_64.rpm
is there a way that orbit install that package? because we using puppet already to deploy osquery package/updates. deploying orbit onetime using puppet and orbit keeping the osquery package updated is the intended workflow right? or i’m missing something.zwass
06/29/2021, 5:43 PMAhmed
06/29/2021, 5:45 PMzwass
06/29/2021, 6:11 PMAhmed
06/29/2021, 9:32 PMzwass
06/30/2021, 4:39 PM.pkg
, .msi
, .rpm
, .deb
). When the package is installed all of the files and services are configured for Orbit to run and update itself along with osquery.