https://github.com/osquery/osquery logo
Title
s

Scott Lampert

02/03/2021, 9:25 PM
I notice in the new 3.7.1 host details page it lists which enroll secret a host used. Is there a way to reference that in a label yet?
đź‘€ 1
z

zwass

02/03/2021, 10:18 PM
Yeah I know folks have been looking for that. Can someone please file an issue with some exposition of what motivates you to want the feature? We're trying to make sure we understand the use cases well as we prioritize development.
s

Scott Lampert

02/04/2021, 3:26 PM
The nutshell is that we have over 120k hosts and they come in from different fleets with different enroll secrets. It would be great to be able to tag those fleets. Since they all run the same OS there doesn’t appear to be a way to target them by fleet. Also no way to push configurations by fleet. As an aside it also seems to be impossible to target queries to only online hosts. Our fleets are highly dynamic and volatile and we have thousands of instances coming and going in a 24 hour period. This makes the fleet UI show thousands more “new” hosts and “offline” hosts than actually exist apparently.
m

mikermcneil

02/12/2021, 4:50 PM
Hey @Scott Lampert, just a heads up here's what's coming down the pipe re:
doesn’t appear to be a way to target them by fleet. Also no way to push configurations by fleet.
s

Scott Lampert

02/18/2021, 8:02 PM
@mikermcneil I’m not clear on what I should be seeing in that image. Seems like a typical config with no overrides?
z

zwass

02/18/2021, 8:04 PM
Ah, what's not obvious in that image is that there's a Team/environment of hosts that can be targeted for configs. Separating hosts into Teams allows different configs to go to different groups of hosts.
s

Scott Lampert

02/18/2021, 9:51 PM
Now that will be immensely helpful. Still want the labels though 🙂
m

mikermcneil

02/18/2021, 9:57 PM
Noted. Thanks for the feedback!