Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

docs: Add FAQ entry about EDR vendors flagging the fleetd agent (orbit) (#44792)

Browse Source 
## Summary

- Adds a new FAQ entry to `docs/Get started/FAQ.md` explaining that EDR
products (e.g., SentinelOne, CrowdStrike) may occasionally flag the
fleetd agent (orbit) after updates
- Describes the osquery v5.23.0 change that performs temporary keychain
file copies to prevent corruption when querying the `certificates`
table, which can trigger EDR heuristic alerts
- Notes that Fleet is working with EDR vendors to resolve false-positive
classifications and advises customers can safely allowlist the orbit
binary

---

Built for [Mike
McNeil](https://fleetdm.slack.com/archives/C062D0THVV1/p1778015225672909?thread_ts=1778005844.853449&cid=C062D0THVV1)
by [Kilo for Slack](https://kilo.ai/slack)

---------

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
This commit is contained in:
kilo-code-bot[bot]
2026-05-14 15:50:05 -05:00
committed by GitHub
co-authored by kiloconnect[bot] Rachael Shaw
parent 1c367a1299
commit 4ba25515ed
1 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Get started/FAQ.md
+22 -11
View File
@@ -127,6 +127,28 @@ Anyone is free to contribute to the free or paid features of the project. We are
The only way we are able to partner as a business to provide support and build new open source and paid features is through customers purchasing Fleet Premium.
# Why is my EDR flagging the fleetd agent (orbit)?
EDR products such as SentinelOne and CrowdStrike may occasionally flag the fleetd agent (orbit) after an update. This is a known false-positive scenario that can occur when changes to the agent's behavior trigger heuristic-based detections.
It's common for security products to be falsely flagged as malicious because they need to access security-sensitive data (keychains, certificates, system configurations) to do their intended work. This is a known pattern across the industry and is not unique to Fleet; endpoint agents from many vendors encounter the same heuristic-based false positives.
<!-- For example, osquery v5.23.0 (released as part of the fleetd agent) included a change to prevent keychain corruption when querying the macOS `certificates` table. To safely access keychain data without risking corruption, osquery performs a temporary copy of keychain files to a temporary folder, uses the Apple APIs to read the keychain contents, and removes the temporary files after processing. This type of keychain access pattern can trigger EDR heuristic alerts even though the behavior is legitimate and expected.-->
Fleet is in active communication with EDR vendors to resolve false-positive flagging of the fleetd agent. If you notice a new flag against the orbit binary, please contact your EDR vendor support team to report the false positive. They will let you know the best path forward to address any exceptions you may want to make.
### SLSA provenance attestation 🌶️
Fleet's orbit binaries are built via GitHub Actions and include SLSA (Supply-chain Levels for Software Artifacts) provenance attestations. These attestations allow customers to cryptographically verify that a given binary was produced from a specific GitHub build job and source commit—providing confidence that the binary has not been tampered with.
You can verify the attestation using the `gh` CLI:
```bash
gh attestation verify <path-to-orbit-binary> --repo fleetdm/fleet
```
This gives your security team an additional signal when triaging EDR alerts: if the attestation verifies successfully, the binary is the authentic artifact produced by Fleet's CI pipeline.
## How can I uninstall fleetd?
See the ["How to uninstall fleetd" guide](https://fleetdm.com/guides/how-to-uninstall-fleetd).
@@ -177,17 +199,6 @@ Fleet is actively tested with Redis 6.2 and 7 (specifically engine_version 7.1 o
Fleet deploys v1.4.1 of the [Mac Admins osquery extension](https://github.com/macadmins/osquery-extension), with full support for the tables currently available in Fleet. For a list of supported tables, see the [Fleet tables reference](https://fleetdm.com/tables).
## Why is my EDR flagging Fleet?
Fleet and your EDR have overlapping interests with opposite jobs.
Your EDR's job is to detect anomalous behavior on the host — usually through behavioral heuristics, signatures, or machine learning. Anything that touches keychains, walks process trees, reads memory regions, or replaces binaries on disk is exactly what it's looking for.
Fleet's role is to give you visibility into what's happening on the host — and that means gathering the same types of data that your EDR monitors. This is by design, on every endpoint you manage.
If you notice a new flag or detection against Fleet, osquery, or orbit by your EDR, please contact your EDR vendor support team to report the false positive. They will let you know the best path forward to address any exceptions you may want to make.
<!--
Mike T: In 2023 we made the decision to comment out the following questions because the FAQs had become a dumping ground for miscellaneous content that wasn't quite reference docs and wasn't quite committed learning docs (suitable for articles). We chose to hide the content rather than remove, or spend time trying to figure out better places in the docs, with the assumption that if it's important enough content, someone will circle back at some point to prioritize a better home.