i can see we can get packs and or queries or packs including queries . but i don’t seem to be able to find the schedule section

fleet 4.27 btw

😕 im not sure i necessarily understand packs vs queries either. I don’t recall creating a pack but one of the scheduled queries shows up in packs

./fleetctl get packs --yaml 

---
apiVersion: v1
kind: pack
spec:
  description: test
  disabled: false
  id: 2
  name: test_pack
  queries:
  - description: ""
    interval: 7200
    name: heartbeat
    platform: all
    query: heartbeat
    removed: false
    snapshot: true
    version: ""
  targets:
    labels: null
    teams: null

and the pack interval for the query is 2h which is neither of the scheduled queries

as opposed to

<https://fleetdm.com/docs/using-fleet/rest-api#example70>

GET /api/v1/fleet/global/schedule

{
  "global_schedule": [
    {
      "created_at": "0001-01-01T00:00:00Z",
      "updated_at": "0001-01-01T00:00:00Z",
      "id": 1,
      "pack_id": 1,
      "name": "heartbeat",
      "query_id": 1,
      "query_name": "heartbeat",
      "query": "SELECT * FROM osquery_info LIMIT 1;",
      "interval": 3600,
      "snapshot": true,
      "removed": false,
      "platform": "",
      "version": "",
      "shard": null,
      "denylist": null,
      "stats": {
        "system_time_p50": 2.375,
        "system_time_p95": 32,
        "user_time_p50": 1.0789,
        "user_time_p95": 5.875,
        "total_executions": 1267
      }
    },
    {
      "created_at": "0001-01-01T00:00:00Z",
      "updated_at": "0001-01-01T00:00:00Z",
      "id": 3,
      "pack_id": 1,
      "name": "testingaudit",
      "query_id": 28,
      "query_name": "testingaudit",
      "query": "SELECT * FROM osquery_info LIMIT 1;",
      "interval": 86400,
      "snapshot": true,
      "removed": false,
      "platform": "all",
      "version": "",
      "shard": null,
      "denylist": null,
      "stats": {
        "system_time_p50": 0,
        "system_time_p95": 19.5,
        "user_time_p50": 0,
        "user_time_p95": 5.3333,
        "total_executions": 52
      }
    }
  ]
}

🤔 😕

so let me get this this straight….from reading up a bit and playing with fleetctl/ui 1. i can do packs via yaml files . a. packs can include 1 plus queries each with own schedule interval, and the pack def is basically a set of query refs + intervals b. for target labels - only 1 label per pack? (i.e the whole pack is targeted not individual query) c. if i do snapshot on for packs it will go to what i have defined in server config (in our case pubsub)? d. you can manage packs via fleetctl including backing up queries associated with it? 2. scheduled queries in the ui can target all hosts only … adhoc queries can target labels ? a. schedule is api only - not fleetctl 3. teams/groups in fleet premium can target tldr to manage query scheduling and testing as a free user fleectl + packs (with optionally multiple queries) + labels is the best and only option? with 1 target (but can do multiple labels in that target) per pack. or to rephrase a bit, to target a specific label - have to use packs?

are packs eol for fleetctl/api?

1. You can currently manage Packs using the REST API or

fleetctl

a. A pack is essentially a wrapper for a group of scheduled queries with the same target b. Each pack can target multiple labels. The same labels apply to all queries in the pack. c. Each query can use one of three logging types based on the values for

snapshot

and

removed

i. Snapshot set to `true`: 1. Snapshot - The results include all rows every run ii. Both set to `false`: 1. Differential - The results include all rows the first run, then only include rows added or removed since the previous run iii. Snapshot set to

false

, Removed set to

true:

1. Differential, but ignore removed rows - The results include all rows the first run, then only include rows added or removed since the previous run d. You can manage both Packs and Queries through

fleetctl

. If a query associated with a pack is deleted, the query will also be removed from the pack. As of v4.27.0, you can export your packs with the associated queries using

fleetctl get packs --yaml --with-queries

can you please provide a yaml example of a query with a schedule to apply via fleetctl, targeted to a specific target label