diff --git a/docs/Contributing/architecture/software/software-inventory.md b/docs/Contributing/architecture/security-compliance/software-inventory.md similarity index 100% rename from docs/Contributing/architecture/software/software-inventory.md rename to docs/Contributing/architecture/security-compliance/software-inventory.md diff --git a/docs/Contributing/architecture/software/vulnerability-management.md b/docs/Contributing/architecture/security-compliance/vulnerability-management.md similarity index 88% rename from docs/Contributing/architecture/software/vulnerability-management.md rename to docs/Contributing/architecture/security-compliance/vulnerability-management.md index 684fa64d7b..e82613a0b0 100644 --- a/docs/Contributing/architecture/software/vulnerability-management.md +++ b/docs/Contributing/architecture/security-compliance/vulnerability-management.md @@ -35,5 +35,3 @@ To learn more, read our [vulnerability processing](https://fleetdm.com/guides/vu - [Vulnerability processing guide](https://fleetdm.com/guides/vulnerability-processing) - [Software filtering guide](https://fleetdm.com/guides/filtering-software-by-vulnerability) - [Remediating the cx vulnerability with Fleet guide](https://fleetdm.com/guides/remediating-the-xz-vulnerability-with-fleet) -- [Software Product Group Documentation](../../product-groups/software/) - Documentation for the Software product group -- [Software Development Guides](../../guides/software/) - Guides for Software development diff --git a/docs/Contributing/architecture/software/vulnerability-processing.md b/docs/Contributing/architecture/security-compliance/vulnerability-processing.md similarity index 100% rename from docs/Contributing/architecture/software/vulnerability-processing.md rename to docs/Contributing/architecture/security-compliance/vulnerability-processing.md diff --git a/docs/Contributing/architecture/software/README.md b/docs/Contributing/architecture/software/README.md index 9bf24cfd6c..21f9d03202 100644 --- a/docs/Contributing/architecture/software/README.md +++ b/docs/Contributing/architecture/software/README.md @@ -1,6 +1,6 @@ # Software architecture -Fleet's software architecture is designed to manage software across the device fleet, including software inventory, vulnerability management, and software installation. This directory contains documentation about Fleet's software architecture. +Fleet's software architecture is designed to manage software across the device fleet, including software inventory and software installation. This directory contains documentation about Fleet's software architecture. ## Contents @@ -14,4 +14,4 @@ Fleet's software architecture is designed to manage software across the device f ## Related resources -- [Software Product Group Documentation](../../product-groups/software/) - Documentation for the Software product group \ No newline at end of file +- [Software Product Group Documentation](../../product-groups/software/) - Documentation for the Software product group diff --git a/docs/Contributing/architecture/software/software-automations.md b/docs/Contributing/architecture/software/software-automations.md index ef44fb6766..8a51de5547 100644 --- a/docs/Contributing/architecture/software/software-automations.md +++ b/docs/Contributing/architecture/software/software-automations.md @@ -1,10 +1,10 @@ -# Software policies architecture +# Software automation architecture This document provides an overview of Fleet's software automation architecture. ## Introduction -Software automation in Fleet enable organizations automatically install or update software based on a policy. +Software automation in Fleet enable organizations automatically install or update software based on a [policy](https://fleetdm.com/securing/what-are-fleet-policies). ## Architecture overview @@ -19,4 +19,3 @@ Software automation in Fleet enable organizations automatically install or updat ## Related resources - [Software Product Group Documentation](../../product-groups/software/) - Documentation for the Software product group -- [Software Development Guides](../../guides/software/) - Guides for Software development \ No newline at end of file diff --git a/docs/Contributing/architecture/software/software-installation.md b/docs/Contributing/architecture/software/software-installation.md index 00414e569e..10858292ff 100644 --- a/docs/Contributing/architecture/software/software-installation.md +++ b/docs/Contributing/architecture/software/software-installation.md @@ -13,13 +13,23 @@ interactions specific to the Software Installation functionality. ### Software types Fleet supports 3 different types of installable software: custom packages, Fleet-maintained apps, -and VPP apps. +and app store apps. #### Custom packages Custom packages are software packages whose installer is uploaded directly to Fleet by an admin. -Fleet supports `.pkg`, `.msi`, `.exe`, `.deb.`, and `.rpm` installers for custom packages. +Fleet supports the following installer files as custom packages + +| Installer file extension | Supported platform(s) | +| ----------- | ----------- | +| .pkg | macOS | +| .ipa | iOS, iPadOS | +| .msi | Windows | +| .exe | Windows | +| .deb | Debian-based Linux | +| .rpm | RHEL-based Linux | + #### Fleet-maintained apps @@ -27,21 +37,21 @@ Fleet-maintained apps are software that Fleet curates. Fleet sources installers install and uninstall scripts for Fleet-maintained apps, so that admins can add them to their software library with just a few clicks. -#### VPP apps +#### App store apps -VPP apps are apps that can be added using Apple's Volume Purchasing Program functionality. These -apps are only for Apple devices (macOS, iOS, and iPadOS) and are managed using the Apple MDM protocol. +App store apps are software that is installed directly from an external app store. Fleet currently supports +the Apple App Store (via [VPP](https://developer.apple.com/documentation/devicemanagement/managing-apps-and-books-through-web-services-legacy) apps (for macOS, iOS, and iPadOS hosts)) +and the Google Play Store (for Android hosts). -## Architecture overview +## Architecture diagrams -## Key components +### VPP app install and verification -## Architecture diagram +VPP apps are installed using the Apple MDM protocol. When an install is triggered, Fleet sends an `InstallApplication` command +to the host. -### VPP app install verification - -Fleet verifies VPP app installs by sending a series of `InstalledApplicationList` MDM commands after -the acknowledgment of the `InstallApplication` command. It attempts to verify until either +To verify that the install was successful, Fleet sends a series of `InstalledApplicationList` MDM commands after +the acknowledgment of the `InstallApplication` command. Fleet attempts to verify until either - the app shows up in the `InstalledApplicationList` response as installed, or - the verification timeout (defaults to 10m, configurable via the `FLEET_SERVER_VPP_VERIFY_TIMEOUT` env var). @@ -50,19 +60,22 @@ the acknowledgment of the `InstallApplication` command. It attempts to verify un ```mermaid sequenceDiagram autonumber - Fleet->>+Host: InstallApplicationCommand - Host-->>-Fleet: Acknowledged + Note over Fleet,Host: Installation + Fleet->>+Host: InstallApplicationCommand + Host-->>-Fleet: Acknowledged - Fleet->>+Fleet: Start timeout - - loop Verification loop - Fleet->>+Host: InstalledApplicationListCommand - Host-->>-Fleet: Acknowledged
[list of apps] - critical Check app status - option app in list, installed, exit: - Fleet->>+Fleet: Move status to "Installed" - option app not in list, timeout: - Fleet->>+Fleet: Move status to "Failed" + Note over Fleet,Host: Verification + + Fleet->>+Fleet: Start timeout + + loop Verification loop + Fleet->>+Host: InstalledApplicationListCommand + Host-->>-Fleet: Acknowledged
[list of apps] + critical Check app status + option app in list, installed, exit: + Fleet->>+Fleet: Move status to "Installed" + option app not in list, timeout: + Fleet->>+Fleet: Move status to "Failed" end end ``` @@ -106,19 +119,6 @@ graph TD end ``` -## Platform-specific implementations - -### macOS - -### Windows - -### Linux - -### iOS/iPadOS - -### Android - ## Related resources - [Software product group documentation](../../product-groups/software/) - Documentation for the Software product group -- [Software development guides](../../guides/software/) - Guides for Software development \ No newline at end of file diff --git a/docs/Contributing/architecture/software/software-overview.md b/docs/Contributing/architecture/software/software-overview.md index 3922c1f45e..ff52a3dcbc 100644 --- a/docs/Contributing/architecture/software/software-overview.md +++ b/docs/Contributing/architecture/software/software-overview.md @@ -22,28 +22,6 @@ The Software architecture consists of the following main components: [Placeholder for Software Architecture Diagram] ``` -## Software inventory - -The Software Inventory component collects and manages information about installed software on devices. It leverages osquery's capabilities to collect software information and Fleet's infrastructure to process and display it. - -### Inventory collection flow - -1. osquery agent collects software information using osquery tables. -2. osquery agent sends the information to the Fleet server. -3. Server processes and stores the information in the database. -4. UI displays the information to users. - -## Vulnerability management - -The Vulnerability Management component identifies and manages software vulnerabilities in the device fleet. It compares installed software versions with known vulnerabilities and provides information about affected devices. - -### Vulnerability identification flow - -1. Server retrieves software inventory information from the database. -2. Server compares software versions with vulnerability databases. -3. Server identifies vulnerable software and affected devices. -4. UI displays vulnerability information to users. - ## Software installation The Software Installation component manages the installation of software on devices. It leverages platform-specific mechanisms to install software packages. @@ -67,4 +45,3 @@ The Software architecture integrates with the following components: ## Related resources - [Software Product Group Documentation](../../product-groups/software/) - Documentation for the Software product group -- [Software Development Guides](../../guides/software/) - Guides for Software development \ No newline at end of file diff --git a/docs/Contributing/architecture/software/software-updates.md b/docs/Contributing/architecture/software/software-updates.md index faa65fbab6..93f43a3a4d 100644 --- a/docs/Contributing/architecture/software/software-updates.md +++ b/docs/Contributing/architecture/software/software-updates.md @@ -35,4 +35,3 @@ The software updates architecture enables the identification, configuration, and ## Related resources - [Software product group documentation](../../product-groups/software/) - Documentation for the software product group -- [Software development guides](../../guides/software/) - Guides for software development \ No newline at end of file