Vlad Previn
01/18/2023, 5:03 AMVlad Previn
01/18/2023, 5:05 AMVlad Previn
01/18/2023, 5:05 AMVlad Previn
01/18/2023, 5:06 AMAs a workaround, Fleet's manual labels provide a way to create groups of hosts without a query. These manual labels can then be used as targets for queries or query packs.
Vlad Previn
01/18/2023, 5:06 AMVlad Previn
01/18/2023, 5:45 AMVlad Previn
01/18/2023, 6:39 AMVlad Previn
01/18/2023, 7:42 AMSELECT * FROM system_info where computer_name IN ('A','B');
Vlad Previn
01/18/2023, 7:42 AMVlad Previn
01/18/2023, 7:44 AMKathy Satterlee
01/18/2023, 3:29 PMSELECT 1
just to keep things streamlined.
If using fleetctl
rather than the API endpoint is an option, creating a manual label would be a bit more efficient:
https://fleetdm.com/docs/using-fleet/configuration-files#labelsVlad Previn
02/03/2023, 7:27 AMapiVersion: v1
kind: label
spec:
name: slack_not_running
query: >
SELECT * FROM system_info
WHERE NOT EXISTS (
SELECT *
FROM processes
WHERE name LIKE "%Slack%"
);
does it add a new label (or update it if exists) , or remove all labels and add this one (replace all label type attrobs)Kathy Satterlee
02/03/2023, 7:15 PMKathy Satterlee
02/03/2023, 7:18 PM