Marc Roelofs
03/03/2022, 2:02 PMTomas Touceda
03/03/2022, 3:08 PMSarah Gillespie
03/03/2022, 6:16 PMid
the all hosts label using GET /api/v1/fleet/labels
endpoint. In the results, you should find an entry that looks something like this:
{
"labels": [
{
"created_at": "2022-02-14T15:58:54Z",
"updated_at": "2022-02-14T15:58:54Z",
"id": 6,
"name": "All Hosts",
"description": "All hosts which have enrolled in Fleet",
"query": "select 1;",
"platform": "",
"label_type": "builtin",
"label_membership_type": "dynamic",
"host_count": 2010,
"display_text": "All Hosts",
"count": 2010,
"host_ids": null
},
The id
might be different in your instance so I recommend confirming just to be sure.
Then you can plug that into the body of your prior request to the POST /api/v1/fleet/queries/run
endpoint, something like this:
{
query: "SELECT * FROM osquery_info;",
query_id: 60,
selected: {
hosts: [],
labels: [6],
teams: []
},
}
You can also target subsets of hosts using the other builtin labels or set up your own custom labels./GET
endpoint. The /POST
endpoint works with a websocket connection so it may not be a fit for your use case.Marc Roelofs
03/04/2022, 6:59 AM