Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

fleet-mcp: run multi-host live queries via ad-hoc campaign so observer_plus works

Browse Source 
Resolves #46005 

Implement flow for ad-hoc distributed query campaign streamed over the
/api/v1/fleet/results/websocket endpoint, the same way the Fleet UI and
fleetctl run live queries.
This commit is contained in:
Juan Fernandez
2026-06-26 12:07:13 -04:00
committed by GitHub
parent 19caa5ce8c
commit 005bcdcf87
12 changed files with 629 additions and 299 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/46005-fleet-mcp-live-query-observer-plus
+1
View File
@@ -0,0 +1 @@
- Fixed fleet-mcp `run_live_query` returning a 403 error for users with the observer+ role. Multi-host live queries now run as an ad-hoc live query campaign (raw SQL, streamed over the results websocket) instead of creating a temporary saved query, so they require only the live-query permission that observer+ already has.