Ahmed06/29/2021, 2:27 PM
documentations but i couldn’t find. keeping osquery updated started to be a pain, and i wanted to test
which is really promising. is there any doc that get me started? how can i make the source of binaries to be internal rpm repo? because not all machines will reach out to internet, so i would need to host orbit, and osquery packages internally and install orbit for the first time and keep it in sync with the internal repo for any new packages.
Noah Talerman06/29/2021, 2:50 PM
Ahmed06/29/2021, 2:51 PM
download a package that you need to install? i tested with this command which generated an osquery package
sudo ./orbit-package --type rpm --osqueryd-channel edge --fleet-url <https://fleet.internal.com:443> --enroll-secret $(cat /etc/osquery/osquery_enroll_secret) --fleet-certificate=/etc/osquery/fleet_cert.pem -- --flagfile=/etc/osquery/osquery.flags
is there a way that orbit install that package? because we using puppet already to deploy osquery package/updates. deploying orbit onetime using puppet and orbit keeping the osquery package updated is the intended workflow right? or i’m missing something.
2021-06-29T11:42:08-04:00 INF wrote package path=orbit-osquery-0.0.2.x86_64.rpm
zwass06/29/2021, 5:43 PM
Ahmed06/29/2021, 5:45 PM
zwass06/29/2021, 6:11 PM
Ahmed06/29/2021, 9:32 PM
zwass06/30/2021, 4:39 PM
). When the package is installed all of the files and services are configured for Orbit to run and update itself along with osquery.