Title
#kolide
pirxthepilot

pirxthepilot

11/14/2018, 10:18 PM
Is there a way to push YARA config using fleet 1.0.9?
marpaia

marpaia

11/15/2018, 12:48 AM
if you upgrade to fleet 2.0.0, you can distribute any osquery configurations you need with the
fleetctl
CLI
pirxthepilot

pirxthepilot

11/15/2018, 12:52 AM
that's great! and is 2.0.0 backwards compatible with osquery 2.x versions? we are still running 2.11.2.
marpaia

marpaia

11/15/2018, 12:53 AM
i haven’t tested that exactly if i’m being honest, but i would expect it to be ok
12:53 AM
but for sure test it if upgrading osquery is out of the question
12:53 AM
but consider updating osquery too 🙂
pirxthepilot

pirxthepilot

11/15/2018, 12:55 AM
we definitely will, it will just take time cos we have many thousands of endpoints haha. say we stick with fleet 1.0.9 for now, will yara config still be possible there?
marpaia

marpaia

11/15/2018, 12:58 AM
if you could independently distribute the yara sigs, you might be able to do some tom foolery at the database shell to make it happen
12:58 AM
but i really suggest testing out osquery 2.11.2 with fleet 2.0.0
12:59 AM
it almost definitely works
12:59 AM
2.11.2 was a pretty stable release
12:59 AM
the last of the 2's iirc
pirxthepilot

pirxthepilot

11/15/2018, 1:01 AM
hmm yeah sounds like a good opportunity to upgrade to 2.0. looking forward to fleetctl, btw 🙂 thanks Mike!
8p8c

8p8c

11/15/2018, 1:21 AM
How would you get the yara signature file into fleet so that you could it get to endpoints?
marpaia

marpaia

11/15/2018, 1:21 AM
yara signatures are loaded from disk, always
1:21 AM
fleet is just saying where they are on the filesystem
8p8c

8p8c

11/15/2018, 1:25 AM
Am I misunderstanding if i think that one would not be able to get the signature file out there with the help of only fleet[ctl]?
marpaia

marpaia

11/15/2018, 2:33 AM
yeah, that is more of a matter of how you deploy and configure osquery on individual hosts. this is more of a problem that launcher aims to help with, although launcher doesn’t currently have any features that enable distributing and maintaining yara signatures.
8p8c

8p8c

11/15/2018, 2:35 AM
👍 thanks for clarifying!
marpaia

marpaia

11/15/2018, 2:35 AM
of course, happy to help, this whole ecosystem can be pretty confusing at times