https://github.com/osquery/osquery logo
#kolide
Title
# kolide
t

teoseller

10/01/2018, 3:26 PM
dear i have a question, if i have for example 100 machine and i want to execute a specific query on a specific host and i know only the ip address, can i search the in the fleet connected on the server by ip address?
s

stefanmaerz

10/01/2018, 4:09 PM
the simple solution is from the command line I'd type
host 192.168.0.1
and grab a hostname from DNS (assuming it is in your DNS).
otherwise I think you can get that info from fleet
s

spookerlabs

10/01/2018, 6:56 PM
Sorry! Wrote in pt_BR before. Maybe a discovery query and so a query you want ? Not sure if it works with fleet.
t

teoseller

10/02/2018, 7:40 AM
in fleet when you want run a query you can search by hostname the host that must run the query, but it's impossibile to search by ip or mac address
it could be a good feature
s

stefanmaerz

10/02/2018, 3:48 PM
SELECT * FROM interface_details where mac="<mac address here>";
and
select address from interface_addresses where address = "<ip address here>";
will return host names based on mac address or ip address respectively. Does that answer your question?
you would need to select "all hosts" as your target.