Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity

Update Ask-questions-about-your-devices.md (#1575)

Browse Source 
Checked and fixed a couple of typos here and there, and made some edits to some of the sentence structure to improve the flow, and to soften the tone a bit.
This commit is contained in:
Mike Thomas
2021-08-11 12:15:49 +09:00
committed by GitHub
parent 7425aa93c9
commit 41e8ab271c
1 changed files with 21 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/1-Using-Fleet/tutorials/Ask-questions-about-your-devices.md
+21 -23
View File
@@ -6,35 +6,33 @@ This tutorial covers the following Fleet concepts:
- Where to see your devices in Fleet
- How to add Fleet's standard query library
- How to asking questions about your devices by running queries
- How to ask questions about your devices by running queries
### Devices in Fleet
Immediately after logging in to Fleet, you're presented with the **Hosts** page. In Fleet, devices are called "hosts."
Once you log into Fleet, you're presented with the **Hosts** page. In Fleet, devices are refered to as "hosts."
On this page you'll see 7 hosts. These hosts are simulated, Linux devices and, like the Fleet preview environment, they're running locally on your computer in Docker.
On this page you'll see 7 hosts. These hosts are simulated Linux devices, and like the Fleet preview environment, they're running locally on your computer in Docker.
In this tutorial we'll be asking questions about these devices by running some queries against them.
In this tutorial you'll be asking questions about these devices by running some queries against them.
### Add queries
Fleet uses queries to determine the information to return from your devices. Put simply, a query is a specific question you can ask about your devices.
> Fleet facilitates providing the answer to these questions by communicating to the osquery agent that runs on any device. To learn more about osquery, check out [the osquery documentation](https://osquery.readthedocs.io/en/stable/).
> Fleet facilitates providing the answer to these questions by communicating with the osquery agent that runs on any given device. To learn more about osquery, check out [the osquery documentation](https://osquery.readthedocs.io/en/stable/).
In Fleet, select the "Queries" tab from the top navigation bar. You should see an empty "Queries" table. This is because you don't have any queries yet in your Fleet.
We'll now populate your Fleet with Fleet's standard query library.
In Fleet, select the "Queries" tab from the top navigation bar. On first load the "Queries" table is empty, so let's populate it with Fleet's standard query library.
First, head to the following file in the fleetdm/fleet GitHub repository: https://github.com/fleetdm/fleet/blob/main/docs/1-Using-Fleet/standard-query-library/standard-query-library.yml
Copy the contents of this file into a new file on you local computer called `standard-query-library.yml`. Please note where this file is located in your local filesystem.
Copy the contents into a new file on your local computer called `standard-query-library.yml`. Please note where this file is located in your local filesystem.
> You can manage your Fleet with configuration files in yaml syntax. This concept might be familiar to those that have used Kubernetes or another tool that offers yaml configuration files. Checkout [the configuration file documentation](../configuration-files/README.md) for more information on managing Fleet with configuration files.
> You can manage your Fleet with configuration files in yaml syntax. This concept might be familiar to those who have used Kubernetes, or other tools, that offer yaml configuration files. Check out [the configuration file documentation](../configuration-files/README.md) for more information on managing Fleet with configuration files.
Now, we're going to use the `fleetctl` command-line tool to import the queries into Fleet.
Now, you can use the `fleetctl` command-line tool to import the queries into Fleet.
Login to `fleetctl` by running the following command in your terminal window:
Log in to `fleetctl` by running the following command in your terminal window:
```
fleetctl login
@@ -50,38 +48,38 @@ fleetctl apply -f standard-query-library.yml
> If you received a message that looks like `open standard-query-library.yml: no such file or directory` you may need to confirm the absolute path to your `standard-query-library.yml` file and change this in the command above.
Success! Now, refresh the **Queries** page in the Fleet. You should see the "Queries" table populated with Fleet's standard query library.
Success! Now, refresh the **Queries** page in the Fleet, and the "Queries" table will be populated with Fleet's standard query library.
### Asking questions by running queries
Now, you're going to ask the following questions about the simulated, Linux hosts connected to your Fleet:
Let's ask the following questions about the simulated Linux hosts connected to your Fleet:
1. What version of OpenSSL is installed on each device if any?
1. What version of OpenSSL is installed on each device, if any?
2. Do these devices have a high severity vulnerable version of OpenSSL installed?
To answer these questions with Fleet, you're going to run the following query: "Detect Linux hosts with high severity vulnerable versions of OpenSSL."
These questions can easily be answered with Fleet, by running the following query: "Detect Linux hosts with high severity vulnerable versions of OpenSSL."
On the **Queries** page, find this query by entering the query's name in the search bar. In the "Queries" table, select this query to navigate to the **Edit or run query** page.
On the **Queries** page, enter the query name, "Detect Linux hosts with high severity vulnerable versions of OpenSSL," in the search bar, and select it from the table to navigate to the **Edit or run query** page.
Next, select the "Select targets" dropdown and then select the purple "+" icon to the right of "All hosts." This means we'll be attempting to run this query against all hosts connected to your Fleet.
On the **Edit or run query** page, open the "Select targets" dropdown, and press the purple "+" icon to the right of "All hosts." This means we'll be attempting to run this query against all hosts connected to your Fleet.
Next, select the "Run" button to run the query. The query may take several seconds to complete because Fleet must wait for the osquery agents to respond with results.
Now hit the "Run" button to run the query, and you're done. The query may take several seconds to complete because Fleet has to wait for the osquery agents to respond with results.
> Fleet's query response time is inherently variable because of osquery's heartbeat response time. This helps prevent performance issues on hosts.
When the query has finished, you should see 4 columns and several rows in the "Results" table:
- The "hostname" column answers: which device responded for a given row of results?
- The "name" column answers: what is the name of the installed software item? The query you just ran asked for all software items that contain "openssl" in their name, so each row in this column should contain "openssl."
- The "name" column answers: what is the name of the installed software item? The query we just ran asked for all software items that contain "openssl" in their name, so each row in this column should contain "openssl."
- The "source" column answers: what osquery table is the result coming from? For more information on the table's available in osquery, check out the [osquery schema documentation](https://osquery.io/schema).
- The "source" column answers: which osquery table is the result coming from? For more information on the table's available in osquery, check out the [osquery schema documentation](https://osquery.io/schema).
- The "version" column answers: which version of the software item was detected on this device?
The "Results" table presented in Fleet answers our first question of interest which was "What version of OpenSSL is installed on each device if any?"
The "Results" table presented in Fleet answers our first question of interest which was "What version of OpenSSL is installed on each device, if any?"
Next, you can compare the results in the "version" column to table below which includes the high severity vulnerabilities reported by [OpenSSL](https://www.openssl.org/news/vulnerabilities.html).
Now you have the results from your query, you can compare the results from the "version" column to the table below, which includes the high severity vulnerabilities reported by [OpenSSL](https://www.openssl.org/news/vulnerabilities.html).
| OpenSSL version range | Vulnerability (CVE) |