to convert osquery pack JSON into the fleetctl yaml format. Then you can apply the yaml.
Mark C.06/28/2018, 1:51 PM
If I run that the output in the terminal is the pack in the expected yml format.
fleetctl convert --config /usr/share/fleet/test-config.yml -f ~/query-packs/windows-attacks.conf --context windows_attacks --debug
is unchanged and
is unchanged also. is this specifically for the fleet-cli? I see there is an example for a single file config and the multi file config but both fleet configurations look completely different than mine.
brandon06/28/2018, 6:09 PM
flag is for the
config, not for Fleet, so this config file will not look like the example configs. When you run
no files are changed. Instead, if you want to apply the windows-attacks pack to a Fleet instance, I would use
fleetctl convert -f ~/query-packs/windows-attacks.conf > windows-attacks.yml
fleetctl apply --config /usr/share/fleet/test-config.yml --context windows_attacks -f windows-attacks.yml
goes to stdout, so you can pipe it to wherever you like with your shell and then apply it.
Mark C.06/28/2018, 6:33 PM
is set to something greater than 0) 🙂
Mark C.06/28/2018, 7:05 PM
works as expected
is not. Fleetctl is prompting to set the address in the config. I think I might have made an assumption that the GUI and CLI configs were similar, but not?
Mark C.06/28/2018, 7:37 PM