https://github.com/osquery/osquery logo
Powered by
#fleet
Title
# fleet
g

grant seltzer

01/11/2021, 8:45 PM
That's how I have it and it's not working as expected (seems to be uuid by default)
z

zwass

01/11/2021, 8:49 PM
for example
Copy code
apiVersion: v1
kind: options
spec:
  config:
    decorators:
      load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
    options:
      disable_distributed: false
      distributed_interval: 10
      distributed_plugin: tls
      distributed_tls_max_attempts: 3
      logger_plugin: tls
      logger_tls_endpoint: /api/v1/osquery/log
      host_identifier: hostname
      pack_delimiter: /
This should return the appropriate value to osquery
I am not 100% that osquery will respect it when sent in the config though (even though it's listed in the section where it should be)
g

grant seltzer

01/11/2021, 8:56 PM
Ah ok thank you! my decorators were messed up
And youre correct that it wouldn't override, the flag file had UUID
6 Views
Powered by