https://github.com/osquery/osquery logo
Title
z

Zach Zeid

08/21/2020, 1:38 PM
if I want to have decorators on queries from fleet, I define them in a config.yaml, does that mean that
fleet serve
needs to reference the file somehow?
s

sundsta

08/21/2020, 2:05 PM
you apply them with
fleetctl
z

Zach Zeid

08/21/2020, 2:21 PM
there is a
yaml
option, I want to avoid using
fleetctl
s

sundsta

08/21/2020, 3:31 PM
Out of curiosity, why?
In any case, you can’t specify the osquery options like decorators from Fleet’s configuration. See here for what you can configure https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#osquery
z

Zach Zeid

08/21/2020, 3:43 PM
this (https://github.com/kolide/fleet/blob/master/examples/config-single-file.yml) leads me to believe I can load a default config
s

sundsta

08/21/2020, 3:44 PM
Those are objects you can use to interact with Fleet’s API (via
fleetctl
)
They are converted to JSON and then sent to Fleet’s API
z

Zach Zeid

08/21/2020, 3:50 PM
fleetctl
is command-line focused and relies on user login to interact w/ fleet (afaik). it's not entirely clear how to install
fleetctl
either. So why couldn't I just interact with the API directly?
s

sundsta

08/21/2020, 3:51 PM
You could, nothing is preventing you. And depending on what you are integrating with, that may be a good option rather than using
fleetctl
. But you would still need to authenticate.
And
fleetctl
is bundled in every release https://github.com/kolide/fleet/releases/tag/3.1.0
z

Zach Zeid

08/21/2020, 3:54 PM
ah I see. 🤔 . then the above config link I posted wouldn't work with
fleet serve --config <config_file
?
s

sundsta

08/21/2020, 3:55 PM
No
The config file has to be set as defined in the docs I linked
z

Zach Zeid

08/21/2020, 3:56 PM
ok so the config file for
fleet serve
is specifically for the fleet binary, and the config file I posted is specifically for
fleetctl
or the API (propertly converted)
s

sundsta

08/21/2020, 4:08 PM
Yep
z

Zach Zeid

08/21/2020, 4:09 PM
I see, thanks!
z

Zach Zeid

08/21/2020, 4:09 PM
👍