https://github.com/osquery/osquery logo
Title
m

Mystery Incorporated

12/01/2022, 11:12 AM
How do you enable the user info queries on teams when you do not have a per team config? or is it a requirement that you create a per team config so you can enable user info queries team by team?
r

Rachel Perkins

12/01/2022, 4:01 PM
Hola, are you talking about the returned users on a device under the hosts api?
m

Mystery Incorporated

12/02/2022, 2:28 AM
Hello, yea in fleet it says it doesn’t show the users because it’s not enabled. So I guess not just the API, the users are also not being listed when I look at the device in fleet
Below is set in config.yml, however it only seems to take effect if a device is not in a team.
features:
  enable_host_users: true
  enable_software_inventory: true
r

Rachel Perkins

12/02/2022, 3:50 PM
The global config should automatically apply to teams and the team config should only override if it's present. So yeah, I would expect users to show on a team if you enabled globally...
I just tried this locally, adding hosts via a team enroll secret without updating the team config to include enable_host_users, and I'm able to see users on that team. Let me see if someone else can reproduce what you're experiencing.
@Mystery Incorporated ok, so just confirmed that you'll need to enable it on the team as well.
The global config should automatically apply to teams and the team config should only override if it's present.
As of a version or two ago, there was a conversation about this and it was too much to correct. Long story short, when you create the team, the global config is copied over. But when the team is existing, if the config is not present, then we assume it's not configured So sorry about that, you'll need to add it to a team config
m

Mystery Incorporated

12/03/2022, 1:49 AM
Ah ok yea you may want to update the documentation to reflect this behaviour then because it was suggestive that defaults would apply unless overriden but it seams in the case of teams the defaults do not apply.
@Rachel Perkins ok so by analysing what you said, deleting the team and recreating it will force it to copy over the global config which is what has happened when I tried it just now. Seems teams config is not honouring the default values listed in the documentation. I.e. if I don’t specify
enable_host_users: true
it should default to true, but whilst it does so globally, the teams config does not apply the same default when not specified.
r

Rachel Perkins

12/05/2022, 5:47 PM
@Mystery Incorporated thank you for continuing to poke at this for us. I'm going to touch base with product/QA to have them hammer intended behavior and that our documentation reflects as such