how does fleet identify the hosts by? for example Windows assign a SID number for a computer and this SID is changeable for some situations… (for example for a domain environment, when a computer unjoin from the domain and join the workgroup and join the domain again, changes the SID of the computer)
I wonder that which method Fleet uses to identify the hosts?
Also i noticed that computer SID number (assigned by windows) and the host_uuid (assigned by osquery) is different values
Which does Fleet uses? SID number? uuid number assigned by osquery? or something different?
07/09/2018, 12:19 PM
not sure, but when you enroll an agent into fleet, there is a flag you use to pass a host identifier to fleet. I would assume that uniquely defines the host.