Hey folks. Right now we are using Fleet (fleetdm) and the regular Osquery. What are the benefits to switching over to "Orbit osquery". I tried looking for some docs but couldn't find any.

orbit is pretty new so that might be why the docs are lacking rn, id look at launcher for the time being

I believe the target audience for Orbit is as an alternative for kolide/launcher and something to help reduce the management overhead of vanilla OSquery config management using a sidecar for those who don’t feel comfortable with traditional Config Management. For example, people use launcher as a quick way of deploying OSquery and getting machines enrolled in the server but now their use case grows and they want to use additional extensions or use advanced runtime flags that is genuinely a PITA with launcher also the fact is uses GRPC as a transport mechanism can also introduce breaking behaviours over vanilla.

Thank you! If I'm understanding things correctly, I can auto update my osquery agents with either launcher or orbit? All remotely? Have not used either. I would prefer orbit since it's created for fleetdm fleet usage. @Gavin @wkleinhenz

yes orbit will auto update based upon a release channel and promotion level managed by the FleetDM team if you want to host / manage your own auto update frequency it will be a pro feature AFAIk.

Oooo. That is good to know @Gavin Thanks.

Yeah thanks Gavin doing my job for me! Orbit is quite new and we do need to further document the motivations. There will be more features coming in Fleet that will be supported only by Orbit, though we expect Launcher to remain compatible. (I wrote substantial portions of Launcher and basically all of Orbit).

Will it support custom extensions as vanilla osquery does?

Yes, Orbit currently lets you set any osquery flags you like, including to set up extensions. The packaging tooling doesn't currently bundle additional files such as extensions but you could make your own package that did so. Definitely planning to add that support though.

Awesome. Thank you.