Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi Fleet Team, I'm looking to validate it a host/end-point is passing a particular policy through API

IS there such a way to do this, currently I can list out the policies and get a count of hosts passing but I am not seeing how to check a given host, I'm hoping I missed something ?

I suspect this may be possible by simply running queries in place of seeking to returned the last run policy state :thinking_face:

You can fetch the host details. That includes policy pass/fail. <https://fleetdm.com/docs/using-fleet/rest-api#get-host>

You can also list hosts based on a particular policy using the `policy_id` and `policy_response`:

<https://fleetdm.com/docs/using-fleet/rest-api#list-hosts>

It's pretty cool how versatile the API is :slightly_smiling_face: Just let me know if that doesn't do the trick and we can dig in.