Just a thing I ran in to regarding: https://fleetdm.com/docs/deploying/faq#what-api-endpoints-should-i-expose-to-the-public-internet It doesn't mention

/api/osquery/log

which is where the scheduled queries/packs etc return to by default. Not sure why its not

/api/v1/osquery/log

or something

Hey @chrismsnz! It's generally recommended to use the

/api/v1/

formatting for endpoints. There are some changes in the works for the API that are slowly being implemented, so some endpoints will work without the version, but all endpoints will work with the version specified. Both

/api/v1/osquery/log

and

/api/osquery/log

will work. I see that we've got some references to

/api/osquery/log

in the configuration documentation, I'll get that updated to use the standard endpoint.

Ah ok they both work! I'll change the agent config then. Thanks

Any time.

I dont remember changing this file so i suspect it's fleet's out of the box agent config

I'm going to run that part up the flagpole 🙂

Sweet, thanks for the update - will keep it in mind going forward