Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

:ocean: I’m excited about the Fleet 3.0 release but I’m trying to think about where the data in  `network_interfaces`  might be used that I’m not thinking of before upgrading. I’ve seen it when a host first enrolls with Fleet but otherwise we’re not *intentionally* using that elsewhere. How were folks using that data prior to the new release?

<https://github.com/kolide/fleet/issues/2207>

:wave: <@U0JFM04MS>. Yup I was reading through that.

So is that data returned every time a host checks in with the Fleet server?

The data was stored in the DB and returned by the API, but never presented to the user.

To clarify that: The primary IP and MAC are presented to the user in the host dashboard. These continue to be presented in Fleet 3.0. For the vast majority of users there is no apparent change. For the small minority that used the data (by consuming from the API or directly from the DB) they can get equivalent data using the additional query functionality.

We’re not interacting with the API or DB directly so we’re in the clear.