Merge remote-tracking branch 'origin/main' into 20320-feat-uninstall-packages
This commit is contained in:
Victor Lyuboslavsky
@@ -12,7 +12,8 @@ You can specify configuration options in the following formats:
|
||||
2. Environment variables
|
||||
3. Command-line flags
|
||||
|
||||
All duration-based settings accept valid time units of `s`, `m`, `h`.
|
||||
- All duration-based settings accept valid time units of `s`, `m`, `h`.
|
||||
- Command-line flags can also be piped in via stdin.
|
||||
|
||||
#### MySQL
|
||||
|
||||
|
||||
@@ -273,14 +273,16 @@ Use `labels_include_all` to only apply (scope) profiles to hosts that have all t
|
||||
|
||||
#### macos_setup
|
||||
|
||||
The `macos_setup` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that automatically enrolled to your old MDM solution.
|
||||
The `macos_setup` section lets you control the out-of-the-box macOS [setup experience](https://fleetdm.com/guides/macos-setup-experience) for hosts that use Automated Device Enrollment (ADE).
|
||||
|
||||
- `bootstrap_package` is the URL to a bootstap package. Fleet will download the bootstrap package (default: `""`).
|
||||
- `enable_end_user_authentication` specifies whether or not to require end user authentication when the user first sets up their macOS host.
|
||||
- `macos_setup_assistant` is a path to a custom automatic enrollment (DEP) profile (.json).
|
||||
- `macos_setup_assistant` is a path to a custom automatic enrollment (ADE) profile (.json).
|
||||
|
||||
#### macos_migration
|
||||
|
||||
The `macos_migration` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that enrolled to your old MDM solution.
|
||||
|
||||
- `enable` specifies whether or not to enable end user migration workflow (default: `false`)
|
||||
- `mode` specifies whether the end user initiates migration (`voluntary`) or they're nudged every 15-20 minutes to migrate (`forced`) (default: `""`).
|
||||
- `webhook_url` is the URL that Fleet sends a webhook to when the end user selects **Start**. Receive this webhook using your automation tool (ex. Tines) to unenroll your end users from your old MDM solution.
|
||||
@@ -585,6 +587,19 @@ org_settings:
|
||||
|
||||
Can only be configured for all teams (`org_settings`).
|
||||
|
||||
##### end_user_authentication
|
||||
|
||||
The `end_user_authentication` section lets you define the identity provider (IdP) settings used for end user authentication during Automated Device Enrollment (ADE). Learn more about end user authentication in Fleet [here](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication-and-eula).
|
||||
|
||||
Once the IdP settings are configured, you can use the [`controls.macos_setup.enable_end_user_authentication`](#macos_setup) key to control the end user experience during ADE.
|
||||
|
||||
- `idp_name` is the human-friendly name for the identity provider that will provide single sign-on authentication (default: `""`).
|
||||
- `entity_id` is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: `""`).
|
||||
- `metadata` is the metadata (in XML format) provided by the identity provider. (default: `""`)
|
||||
- `metadata_url` is the URL that references the identity provider metadata. Only one of `metadata` or `metadata_url` is required (default: `""`).
|
||||
|
||||
Can only be configured for all teams (`org_settings`).
|
||||
|
||||
<meta name="title" value="YAML files">
|
||||
<meta name="description" value="Reference documentation for Fleet's GitOps workflow. See examples and configuration options.">
|
||||
<meta name="pageOrderInSection" value="1500">
|
||||
|
||||
@@ -8511,6 +8511,9 @@ Get a list of all software.
|
||||
| vulnerable | boolean | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`. |
|
||||
| available_for_install | boolean | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`. |
|
||||
| self_service | boolean | query | If `true` or `1`, only lists self-service software. Default is `false`. |
|
||||
| min_cvss_score | integer | query | _Available in Fleet Premium_. Filters to include only software with vulnerabilities that have a CVSS version 3.x base score higher than the specified value. |
|
||||
| max_cvss_score | integer | query | _Available in Fleet Premium_. Filters to only include software with vulnerabilities that have a CVSS version 3.x base score lower than what's specified. |
|
||||
| exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include software with vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Default is `false`. |
|
||||
|
||||
#### Example
|
||||
|
||||
@@ -8630,6 +8633,9 @@ Get a list of all software versions.
|
||||
| query | string | query | Search query keywords. Searchable fields include `name`, `version`, and `cve`. |
|
||||
| team_id | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team. Use `0` to filter by hosts assigned to "No team". |
|
||||
| vulnerable | boolean | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`. |
|
||||
| min_cvss_score | integer | query | _Available in Fleet Premium_. Filters to include only software with vulnerabilities that have a CVSS version 3.x base score higher than the specified value. |
|
||||
| max_cvss_score | integer | query | _Available in Fleet Premium_. Filters to only include software with vulnerabilities that have a CVSS version 3.x base score lower than what's specified. |
|
||||
| exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include software with vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Default is `false`. |
|
||||
|
||||
#### Example
|
||||
|
||||
@@ -9285,7 +9291,6 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
|
||||
| exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Otherwise, includes vulnerabilities with any `cisa_known_exploit` value. |
|
||||
|
||||
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 200`
|
||||
@@ -9320,12 +9325,14 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
|
||||
|
||||
Retrieve details about a vulnerability and its affected software and OS versions.
|
||||
|
||||
If no vulnerable OS versions or software were found, but Fleet is aware of the vulnerability, a 204 status code is returned.
|
||||
|
||||
#### Parameters
|
||||
|
||||
| Name | Type | In | Description |
|
||||
| --- | --- | --- | --- |
|
||||
| cve | string | path | The cve to get information about (including "cve-" prefix, case-insensitive). |
|
||||
| team_id | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team". |
|
||||
| Name | Type | In | Description |
|
||||
|---------|---------|-------|------------------------------------------------------------------------------------------------------------------------------|
|
||||
| cve | string | path | The cve to get information about (format must be CVE-YYYY-<4 or more digits>, case-insensitive). |
|
||||
| team_id | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team". |
|
||||
|
||||
`GET /api/v1/fleet/vulnerabilities/:cve`
|
||||
|
||||
|
||||
Reference in New Issue
Block a user