zwass
06/27/2018, 9:00 PMfleetctl convert
to convert osquery pack JSON into the fleetctl yaml format. Then you can apply the yaml.Mark C.
06/28/2018, 1:51 PMfleetctl convert --config /usr/share/fleet/test-config.yml -f ~/query-packs/windows-attacks.conf --context windows_attacks --debug
If I run that the output in the terminal is the pack in the expected yml format. test-config.yml
is unchanged and ~/query-packs/windows-attacks.conf
is unchanged also. is this specifically for the fleet-cli? I see there is an example for a single file config and the multi file config but both fleet configurations look completely different than mine.brandon
06/28/2018, 6:09 PM--config
flag is for the fleetctl
config, not for Fleet, so this config file will not look like the example configs. When you run fleetctl convert
no files are changed. Instead, if you want to apply the windows-attacks pack to a Fleet instance, I would use fleetctl convert -f ~/query-packs/windows-attacks.conf > windows-attacks.yml
and then fleetctl apply --config /usr/share/fleet/test-config.yml --context windows_attacks -f windows-attacks.yml
.zwass
06/28/2018, 6:13 PMfleetctl convert
goes to stdout, so you can pipe it to wherever you like with your shell and then apply it.Mark C.
06/28/2018, 6:33 PMzwass
06/28/2018, 6:34 PMconfig_refresh
is set to something greater than 0) 🙂Mark C.
06/28/2018, 7:05 PMfleetctl convert
works as expected apply
is not. Fleetctl is prompting to set the address in the config. I think I might have made an assumption that the GUI and CLI configs were similar, but not?zwass
06/28/2018, 7:19 PMfleetctl login
firstMark C.
06/28/2018, 7:37 PMzwass
06/28/2018, 10:20 PM