Title
#fleet
a

Artem

12/15/2020, 2:17 PM
Another question, can we remove some query from denylist using Fleet?
osquery_scheduled
returned denylisted=1 for query, but without any hardware utilization metrics. In my opinion, it looks like mismatch. Is it a way to remove this special query from denylist without direct access to client laptop and not to wait 24 hours?
zwass

zwass

12/15/2020, 4:10 PM
Yes, you can set
denylist: false
in the yaml when scheduling the query. See https://osquery.readthedocs.io/en/stable/deployment/configuration/#schedule.
a

Artem

12/15/2020, 7:20 PM
@zwass thank you for answer! I’ve read this doc, but I’ve not found same functionality in Fleet UI. Also found feature request https://github.com/kolide/fleet/issues/2335. Is that correct, that Fleet UI doesn’t have this feature yet?
zwass

zwass

12/15/2020, 7:39 PM
Yes, you are correct. If this is important for you in the UI please open a feature request in fleetdm/fleet. I think we can support it without too much trouble.
a

Artem

12/15/2020, 9:32 PM
Got it, thanks again!