Vlad Previn
02/17/2023, 8:30 AM./fleetctl get packs --yaml
---
apiVersion: v1
kind: pack
spec:
description: test
disabled: false
id: 2
name: test_pack
queries:
- description: ""
interval: 7200
name: heartbeat
platform: all
query: heartbeat
removed: false
snapshot: true
version: ""
targets:
labels: null
teams: null
<https://fleetdm.com/docs/using-fleet/rest-api#example70>
GET /api/v1/fleet/global/schedule
{
"global_schedule": [
{
"created_at": "0001-01-01T00:00:00Z",
"updated_at": "0001-01-01T00:00:00Z",
"id": 1,
"pack_id": 1,
"name": "heartbeat",
"query_id": 1,
"query_name": "heartbeat",
"query": "SELECT * FROM osquery_info LIMIT 1;",
"interval": 3600,
"snapshot": true,
"removed": false,
"platform": "",
"version": "",
"shard": null,
"denylist": null,
"stats": {
"system_time_p50": 2.375,
"system_time_p95": 32,
"user_time_p50": 1.0789,
"user_time_p95": 5.875,
"total_executions": 1267
}
},
{
"created_at": "0001-01-01T00:00:00Z",
"updated_at": "0001-01-01T00:00:00Z",
"id": 3,
"pack_id": 1,
"name": "testingaudit",
"query_id": 28,
"query_name": "testingaudit",
"query": "SELECT * FROM osquery_info LIMIT 1;",
"interval": 86400,
"snapshot": true,
"removed": false,
"platform": "all",
"version": "",
"shard": null,
"denylist": null,
"stats": {
"system_time_p50": 0,
"system_time_p95": 19.5,
"user_time_p50": 0,
"user_time_p95": 5.3333,
"total_executions": 52
}
}
]
}
Kathy Satterlee
02/17/2023, 4:02 PMtest_pack
🙂fleetctl
a. A pack is essentially a wrapper for a group of scheduled queries with the same target
b. Each pack can target multiple labels. The same labels apply to all queries in the pack.
c. Each query can use one of three logging types based on the values for snapshot
and removed
i. Snapshot set to `true`:
1. Snapshot - The results include all rows every run
ii. Both set to `false`:
1. Differential - The results include all rows the first run, then only include rows added or removed since the previous run
iii. Snapshot set to false
, Removed set to true:
1. Differential, but ignore removed rows - The results include all rows the first run, then only include rows added or removed since the previous run
d. You can manage both Packs and Queries through fleetctl
. If a query associated with a pack is deleted, the query will also be removed from the pack. As of v4.27.0, you can export your packs with the associated queries using fleetctl get packs --yaml --with-queries
Vlad Previn
02/20/2023, 2:47 AM