how does fleet identify the hosts by? for example Windows assign a SID number for a computer and this SID is changeable for some situations… (for example for a domain environment, when a computer unjoin from the domain and join the workgroup and join the domain again, changes the SID of the computer)I wonder that which method Fleet uses to identify the hosts?
Also i noticed that computer SID number (assigned by windows) and the host_uuid (assigned by osquery) is different valuesWhich does Fleet uses? SID number? uuid number assigned by osquery? or something different?
07/09/2018, 12:19 PM
not sure, but when you enroll an agent into fleet, there is a flag you use to pass a host identifier to fleet. I would assume that uniquely defines the host.