Merge branch 'main' into 7765-combined-schedules-and-queries

2023-07-21 13:53:13 -04:00
parent b0c1dba44c 501ef480b0
commit 6b664a2a82
412 changed files with 8469 additions and 2850 deletions
@@ -31,7 +31,7 @@ jobs:

    strategy:
      matrix:
-        node-version: [14.x]
+        node-version: [16.x]

    steps:
    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2
@@ -47,7 +47,7 @@ jobs:

    # Set the Node.js version
    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1
+      uses: actions/setup-node@v3
      with:
        node-version: ${{ matrix.node-version }}

@@ -58,6 +58,9 @@ jobs:
      with:
        go-version: 1.19

+    # Download top-level dependencies and build Storybook in the website's assets/ folder
+    - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose
+
    # Now start building!
    # > …but first, get a little crazy for a sec and delete the top-level package.json file
    # > i.e. the one used by the Fleet server.  This is because require() in node will go
@@ -8,6 +8,7 @@ on:
      - 'handbook/**'
      - 'schema/**'
      - 'articles/**'
+      - '.github/workflows/test-website.yml'

 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -28,17 +29,21 @@ jobs:

    strategy:
      matrix:
-        node-version: [14.x]
+        node-version: [16.x]

    steps:
    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2

    # Set the Node.js version
    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1
+      uses: actions/setup-node@v3
      with:
        node-version: ${{ matrix.node-version }}

+
+    # Download top-level dependencies and build Storybook in the website's assets/ folder.
+    - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose
+
    # Now start building!
    # > …but first, get a little crazy for a sec and delete the top-level package.json file
    # > i.e. the one used by the Fleet server.  This is because require() in node will go
@@ -59,9 +59,7 @@ archives:
  - id: fleet
    builds:
      - fleet
-    name_template: fleet_v{{.Version}}_{{.Os}}
-    replacements:
-      darwin: macos
+    name_template: fleet_v{{.Version}}_{{- if eq .Os "darwin" }}macos{{- else }}{{ .Os }}{{ end }}
    format_overrides:
      - goos: windows
        format: zip
@@ -70,18 +68,14 @@ archives:
  - id: fleetctl
    builds:
      - fleetctl
-    name_template: fleetctl_v{{.Version}}_{{.Os}}
-    replacements:
-      darwin: macos
+    name_template: fleetctl_v{{.Version}}_{{- if eq .Os "darwin" }}macos{{- else }}{{ .Os }}{{ end }}
    wrap_in_directory: true

  - id: fleetctl-zip
    builds:
      - fleetctl
-    name_template: fleetctl_v{{.Version}}_{{.Os}}
+    name_template: fleetctl_v{{.Version}}_{{- if eq .Os "darwin" }}macos{{- else }}{{ .Os }}{{ end }}
    format: zip
-    replacements:
-      darwin: macos
    wrap_in_directory: true

 dockers:
@@ -1,3 +1,97 @@
+## Fleet 4.34.0 (Jul 11, 2023)
+
+* Added execution of programmatic Windows MDM enrollment on eligible devices when Windows MDM is enabled.
+
+* Microsoft MDM Enrollment Protocol: Added support for the RequestSecurityToken messages.
+
+* Microsoft MDM Enrollment Protocol: Added support for the DiscoveryRequest messages.
+
+* Microsoft MDM Enrollment Protocol: Added support for the GetPolicies messages.
+
+* Added `enabled_windows_mdm` and `disabled_windows_mdm` activities when a user turns on/off Windows MDM.
+
+* Added support to enable and configure Windows MDM and to notify devices that are able to programmatically enroll.
+
+* Added ability to turn Windows MDM on and off from the Fleet UI.
+
+* Added enable and disable Windows MDM activity UI.
+
+* Updated MDM detail query ingestion to switch MDM profiles from "verifying" or "verified" status to "failed" status when osquery reports that this profile is not installed on the host.
+
+* Added notification and execution of programmatic Windows MDM unenrollment on eligible devices when Windows MDM is disabled.
+
+* Added the `FLEET_DEV_MDM_ENABLED` environment variable to enable the Windows MDM feature during its development and beta period.
+
+* Added the `mdm_enabled` feature flag information to the response payload of the `PATCH /config` endpoint.
+
+* When creating a PolicySpec, return the proper HTTP status code if the team is not found.
+
+* Added CPEMatchingRule type, used for correcting false positives caused by incorrect entries in the NVD dataset.
+
+* Optimized macOS CIS query "Ensure Appropriate Permissions Are Enabled for System Wide Applications" (5.1.5).
+
+* Updated macOS CIS policies 5.1.6 and 5.1.7 to use a new fleetd table `find_cmd` instead of relying on the osquery `file` table to improve performance.
+
+* Implemented the privacy_preferences table for the Fleetd Chrome extension.
+
+* Warnings in fleetctl now go to stderr instead of stdout.
+
+* Updated UI for transferred hosts activity items.
+
+* Added Organization support URL input on the setting page organization info form.
+
+* Added improved ABM 400 error message to the UI.
+
+* Hide any osquery tables or columns from Fleet UI that has hidden set to true to match Fleet website.
+
+* Ignore casing in SAML response for display name. For example the display name attribute can be provided now as `displayname` or `displayName`.
+
+* Provide feedback to users when `fleetctl login` is using EMAIL and PASSWORD environment variables.
+
+* Added a new activity `transferred_hosts` created when hosts are transferred to a new team (or no team).
+
+* Added milliseconds to the timestamp of auto-generated team name when creating a new team in `GET /mdm/apple/profiles/match`.
+
+* Improved dashboard loading states.
+
+* Improved UI for selecting targets.
+
+* Made sure that all configuration profiles and commands are sent to devices if MDM is turned on, even if the device never turned off MDM.
+
+* Fixed bug when reading filevault key in osquery and created new Fleet osquery extension table to read the file directly rather than via filelines table.
+
+* Fixed UI bug on host details and device user pages that caused the software search to not work properly when searching by CVE.
+
+* Fixed not validating the schema used in the Metadata URL.
+
+* Fixed improper HTTP status code if SMTP is invalid.
+
+* Fixed false positives for iCloud on macOS.
+
+* Fixed styling of copy message when copying fields.
+
+* Fixed a bug where an empty file uploaded to `POST /api/latest/fleet/mdm/apple/setup/eula` resulted in a 500; now returns a 400 Bad Request.
+
+* Fixed vulnerability dropdown that was hiding if no vulnerabilities.
+
+* Fixed scroll behavior with disk encryption status.
+
+* Fixed empty software image in sandbox mode.
+
+* Fixed improper HTTP status code when `fleet/forgot_password` endpoint is rate limited. 
+
+* Fixed MaxBurst limit parameter for `fleet/forgot_password` endpoint.
+
+* Fixed a bug where reading from the replica would not read recent writes when matching a set of MDM profiles to a team (the `GET /mdm/apple/profiles/match` endpoint).
+
+* Fixed an issue that displayed Nudge to macOS hosts if MDM was configured but MDM features weren't turned on for the host.
+
+* Fixed tooltip word wrapping on the error cell in the macOS settings table.
+
+* Fixed extraneous loading spinner rendering on the software page.
+
+* Fixed styling bug on setup caused by new font being much wider.
+
 ## Fleet 4.33.1 (Jun 20, 2023)

 * Fixed ChromeOS add host instructions to use variable Fleet URL.
@@ -1,95 +1,70 @@
-# Go engineers are automatically added as reviewers when changes are made to go
-# files or related backend files.
+##############################################################################################
+#   ██████╗ ██████╗ ██████╗ ███████╗ ██████╗ ██╗    ██╗███╗   ██╗███████╗██████╗ ███████╗
+#  ██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔═══██╗██║    ██║████╗  ██║██╔════╝██╔══██╗██╔════╝
+#  ██║     ██║   ██║██║  ██║█████╗  ██║   ██║██║ █╗ ██║██╔██╗ ██║█████╗  ██████╔╝███████╗
+#  ██║     ██║   ██║██║  ██║██╔══╝  ██║   ██║██║███╗██║██║╚██╗██║██╔══╝  ██╔══██╗╚════██║
+#  ╚██████╗╚██████╔╝██████╔╝███████╗╚██████╔╝╚███╔███╔╝██║ ╚████║███████╗██║  ██║███████║
+#   ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚═════╝  ╚══╝╚══╝ ╚═╝  ╚═══╝╚══════╝╚═╝  ╚═╝╚══════╝
+##############################################################################################
+# ⛔ This file indicates REQUIRED reviewers for changes to certain file paths in this repo.
+#
+# > How? This "requiredness" is provided natively by GitHub.  If a team is specified, then
+# > the logic behaves slightly differently.  See GitHub's latest documentation on CODEOWNERS
+# > for more information.
+#
+# ⚠️ For file paths not listed, the DRI is indicated elsewhere (website/config/custom.js).
+# (In either case, the DRI is automatically requested for review when changes are proposed.)
+#
+# ✅ Some paths also have multiple individuals who are allowed to make changes without review,
+# even though they are not the DRI.  These are called "maintainers".
+#
+# For more information on how this works, see:
+# - What is a DRI and how is this configured? https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility
+# - Historical context: https://github.com/fleetdm/fleet/pull/12786
+##############################################################################################
+
+
+##############################################################################################
+# Golang files and other files related to the core product backend.
+# (1 or more Golang-literate engineers is required to review changes.)
+# FUTURE: Look for a way to not have this notify every single person in this "github team".
+##############################################################################################
 *.go @fleetdm/go
 go.sum @fleetdm/go
 go.mod @fleetdm/go
 /server/ @fleetdm/go
 /cmd/ @fleetdm/go

-# Compliance
-/ee/cis/ @sharon-fdm @lucasmrod @marcosd4h @rachelElysia
-
-# MDM
-/ee/tools/puppet @roperzh @gillespi314 @mna @georgekarrv
-
-# React engineers are automatically added as reviewers when changes are made to react files
+##############################################################################################
+# React files and other files related to the core product frontend.
+# (1 or more React-literate engineers is required to review changes.)
+# FUTURE: Look for a way to not have this notify every single person in this "github team".
+##############################################################################################
 /frontend/ @fleetdm/frontend

-# Infra/terraform
-*.tf @edwardsb @zwinnerman-fleetdm @rfairburn
-/infrastructure/ @zwinnerman-fleetdm @edwardsb @rfairburn
-/charts/ @zwinnerman-fleetdm @edwardsb @rfairburn
-/terraform @zwinnerman-fleetdm @edwardsb @rfairburn
+##############################################################################################
+# Config as code for infrastructure, internal security and IT use cases, and more.
+# (1 or more infra-literate engineers is required to review changes.)
+# FUTURE: Look for a way to not have this notify every single person in this "github team".
+##############################################################################################
+/infrastructure/ @fleetdm/infra
+/charts/ @fleetdm/infra
+/terraform/ @fleetdm/infra

-# GitHub issue templates
-/.github/ISSUE_TEMPLATE @mikermcneil
-
-# Codeowners file
-/CODEOWNERS @mikermcneil
-
-# Changelog
-/CHANGELOG.md @spokanemac
-
-# Fleet documentation (who is auto-requested as reviewer for changes to docs?)
+##############################################################################################
+# Key handbook pages w/ required reviewers
+#
+# (Especially useful for paths that tend to end up in PRs with lots of other reviewers)
+##############################################################################################
+/handbook/company/development-groups.md @mikermcneil
+/handbook/company/why-this-way.md @mikermcneil
+/handbook/company/README.md @mikermcneil
+/handbook/business-operations/README.md @mikermcneil
 /docs/ @rachaelshaw
+/schema/ @rachaelshaw #« Data tables (osquery/fleetd schema) documentation
+CHANGELOG.md @lukeheath

-# REST API reference documentation
-/docs/Using-Fleet/REST-API.md @rachaelshaw
-/docs/Contributing/API-for-contributors.md @rachaelshaw

-# Standard query library YAML
-/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml @zwass

-# Expanded table documentation
-/schema @eashaw
-
-# Articles
-/articles @jarodreyes
-
-# Website
-/website/ @eashaw
-/website/views/ @eashaw
-/website/assets/ @eashaw
-
-# Features table
-# - CEO is DRI for pricing
-# - Mo is DRI for features table
-# - Eric is DRI for website frontend code
-/website/views/pages/pricing.ejs @mikermcneil
-/handbook/product/pricing-features-table.yml @mikermcneil
-
-# Website redirects and URLs
-/website/config/routes.js @mikermcneil @eashaw
-
-# Website backend, scripts, deps
-/website/api/ @mikermcneil @eashaw
-/website/config/ @mikermcneil @eashaw
-/website/scripts/ @mikermcneil @eashaw
-/website/package.json @mikermcneil @eashaw
-
-# GitHub brandfront
-/README.md @mikermcneil
-
-# NPM brandfront (npmjs.com/package/fleetctl)
-/tools/fleetctl-npm/README.md @mikermcneil
-
-# Handbook
-/handbook/company @mikermcneil
-/handbook/company/* @mikermcneil
-/handbook/business-operations @mikermcneil
-/handbook/business-operations/* @mikermcneil
-/handbook/engineering @lukeheath
-/handbook/engineering/* @lukeheath
-/handbook/product @zhumo
-/handbook/product/* @zhumo
-/handbook/customers @alexmitchelliii
-/handbook/customers/* @alexmitchelliii
-/handbook/marketing @jarodreyes
-/handbook/marketing/* @jarodreyes
-/handbook/README.md @mikermcneil # « This is the "Table of contents"
-
-#
-# For configuration that determines auto-approval + auto-unfreezing, so that contributors
-# can merge their own PRs without additional approval, please see the latest version of:
-# https://github.com/fleetdm/fleet/blob/74f65447b718663bd04df31ea1da28915d98792c/website/config/custom.js#L88-L128
-#
+# ℹ️ But wait, there's more!
+# See the comments up top to learn where else DRIs and maintainers are configured.
@@ -4,7 +4,7 @@

 Open-source platform for IT and security teams with thousands of computers.  Designed for APIs, GitOps, webhooks, YAML, and humans.

-<a href="https://fleetdm.com/logos"><img alt="Wallpaper featuring a futuristic cloud city with the Fleet logo" src="https://github.com/fleetdm/fleet/assets/618009/f705c7ee-6efe-448e-b5ee-f5535d7cd101"/></a>
+<a href="https://fleetdm.com/logos"><img alt="https://github.com/fleetdm/fleet/assets/618009/f705c7ee-6efe-448e-b5ee-f5535d7cd101"/></a>


 ## What's it for?
@@ -56,7 +56,7 @@ In keeping with Fleet's value of openness, [Fleet Device Management's company ha
 <!-- > To upgrade from Fleet ≤3.2.0, just follow the upgrading steps for the earliest subsequent major release from this repository (it'll work out of the box until the release of Fleet 5.0). -->


-## Is it any good?
+## Is it any good??
 Fleet is used in production by IT and security teams with thousands of laptops and servers.  Many deployments support tens of thousands of hosts, and a few large organizations manage deployments as large as 400,000+ hosts.


@@ -19,9 +19,13 @@ First let’s get these dependencies up and running on Render.

 Fleet uses MySQL as the datastore to organize host enrollment and other metadata around serving Fleet. Start by forking [https://github.com/edwardsb/render-mysql](https://github.com/edwardsb/render-mysql), then create a new private service within Render. When prompted for the repository — enter your fork’s URL here.

-![Private Service component in Render](../website/assets/images/articles/deploying-fleet-on-render-2-216x163@2x.png)
+![Private Service component in Render](../website/assets/images/articles/deploying-fleet-on-render-1-216x165@2x.png)
 *Private Service component in Render*

+Your private service should look like this:
+![Private Service settings in Render](../website/assets/images/articles/deploying-fleet-on-render-5-450x286@2x.png)
+*Private Service settings in Render*
+
 This private service will run MySQL, our database, so let’s give it a fitting name, something like “fleet-mysql”.

 We’re also going to need to set up some environment variables and a disk to mount. Expand “Advanced” and enter the following:
@@ -39,6 +43,10 @@ We’re also going to need to set up some environment variables and a disk to mo
 - Mount Path: `/var/lib/mysql`
 - Size: `50GB`

+Once you've setup your mysql service on Render we will need to copy the address. You can find that here:
+![mysql address on render](../website/assets/images/articles/deploying-fleet-on-render-6-666x416@2x.png)
+*mysql address on Render*
+
 ---

 ## Redis
@@ -73,7 +81,7 @@ Give it the following environment variables:

 Additionally we’ll configure the following so Render knows how to build our app and make sure its healthy:

-![Additional component details](../website/assets/images/articles/deploying-fleet-on-render-3-512x213@2x.png)
+![Additional component details](../website/assets/images/articles/deploying-fleet-on-render-7-627x416@2x.png)

 - Health Check Path: `/healthz`
 - Docker Build Context Directory: `.`
@@ -97,7 +105,9 @@ Fleet is up and running, head to your public URL.

 You should be prompted with a setup page, where you can enter your name, email, and password. Run through those steps and you should have an empty hosts page waiting for you.

-You’ll find the enroll-secret after clicking “Add New Hosts”. This is a special secret the host will need to register to your Fleet instance. Once you have the enroll-secret you can use `fleetctl` to create Orbit installers, which makes installing and updating osquery super simple. [Download fleetctl](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.3.0) and try the following command (Docker require) on your terminal:
+You’ll find the enroll-secret after clicking “Add hosts”. This is a special secret the host will need to register to your Fleet instance. Once you have the enroll-secret you can use `fleetctl` to generate installers, which makes installing and updating osquery super simple.
+
+To install `fleetctl`, which is the command line interface (CLI) used to communicate between your computer and Fleet, you either run `npm install -g fleetctl` or [download fleetctl](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.3.0) from Github. Once it's installed try the following command (Docker require) on your terminal:

 ```
 fleetctl package --type=msi --enroll-secret <secret> --fleet-url https://<your-unique-service-name>.onrender.com
@@ -0,0 +1,65 @@
+# Embracing the future: Declarative Device Management 
+
+![Embracing the future: Declarative Device Management](../website/assets/images/articles/embracing-the-future-declarative-device-management@2x.png)
+
+As a Mac administrator, managing a fleet of Apple devices across your organization requires consistency and airtight security. With a variety of system services and background tasks to oversee, the challenge is not only to maintain uniform configurations but also to keep the organization's data secure. Recognizing these challenges, Apple has advanced a powerful new approach - Declarative Device Management (DDM).
+
+DDM is a paradigm shift in device management, enabling a more efficient and secure administration of macOS devices. It allows for tamper-resistant configurations and ensures simplified monitoring of system services and background tasks.
+
+In this blog post, we dive into Apple's forthcoming DDM in macOS Sonoma. Specifically, we'll explore how it will alter the way you manage system services, certificates and identities, and how it transitions you from traditional Mobile Device Management (MDM) systems. Whether you're an experienced Mac admin or just getting started, hopefully, this guide will provide some insights into DDM for you and your organization. Let's dive in!
+
+
+## Declarative device management for system services
+
+DDM paves the way for a secure and reliable mechanism to manage system services. Using tamper-resistant system configuration files for different system services ensures uniform and secure configurations across all devices. Declarative Device Management provides an added layer of protection against accidental changes by users.
+
+For instance, system services like sshd, sudo, PAM, CUPS, Apache httpd, bash and Z-shells will be able to adopt managed service configuration files to ensure consistency and compliance. The configuration files reference a data asset that provides a ZIP archive of SSH keys that is downloaded and expanded into a tamper-resistant, service-specific location when required conditions are met—for example, FileVault is enabled—and are always prioritized over any default or overridden system configuration.
+
+
+## Monitoring and compliance rules for background tasks
+
+DDM provides an excellent way of keeping track of background tasks. A new status item in this coming release reports the list of installed background tasks, making it easier to verify that required tasks are running and unwanted tasks aren't.
+
+In addition, the FileVault enabled state of the macOS boot volume is reported, allowing you to install sensitive configurations only when it is safe to proceed. With these features, you can ensure compliance and consistency across all macOS devices in your organization.
+
+
+## Secure access with certificates and identities
+
+Certificates and identities play a crucial role in ensuring secure access to organizational resources. In this context, DDM provides a more efficient mechanism for managing certificates and identities using its declaration data model.
+
+Certificates and identities are defined as asset declarations, which various configurations can reference. This eliminates the need for duplicating certificates and identities across multiple profiles, thereby reducing management overhead.
+
+
+## A new paradigm: software updates
+
+Apple's DDM introduces a redefined software update process, which marks another significant step forward in device management.
+
+Traditionally, administrators have faced considerable challenges in managing software updates. However, with DDM, this process has been dramatically simplified. The Declarative model handles scheduling and applying updates, allowing administrators to specify the desired state – for instance, maintaining the latest software version – and leave the rest to DDM.
+
+To improve upon this functionality, Fleet, with its osquery integration, allows admins to monitor the status of these updates in real time. It provides critical insights about the update process, such as software versions, pending updates, and the update history. These features make the software update process significantly more manageable and transparent.
+
+DDM represents an important advancement in how we manage and understand software updates. It not only will streamline administrative tasks but also elevates the overall security, performance, and integrity of the devices Mac admins manage.
+
+
+## Seamless transition from MDM to DDM
+
+Transitioning from traditional MDM to DDM will be a challenge. However, DDM provides a smooth transition without causing disruption or leaving a management gap. This is achieved by allowing DDM to take over the management of already installed MDM profiles without the need to remove them.
+
+
+## Fleet + osquery + DDM = 💗
+
+The innovations introduced with DDM, including the new software update process, represent a paradigm shift in device management. Fleet's MDM solution, powered by osquery, complements these changes and offers a GitOps-driven management platform for Mac admins.
+
+As we continue to navigate this evolving landscape, we have tools that equip us better than ever to handle the challenges and complexities of modern device management. This new era presents opportunities for enhanced security, control, and efficiency in managing our devices.
+
+Fleet is transforming how we manage and secure devices. Offering an open-core, cross-platform solution, Fleet is committed to empowering Mac admins with the tools they need to meet the challenges of today's and tomorrow's device management. Through its powerful and versatile platform, Fleet is illuminating the path forward in device management.
+
+
+
+<meta name="category" value="announcements">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="authorFullName" value="JD Strong">
+<meta name="publishedOn" value="2023-07-06">
+<meta name="articleTitle" value="Embracing the future: Declarative Device Management">
+<meta name="articleImageUrl" value="../website/assets/images/articles/embracing-the-future-declarative-device-management@2x.png">
+<meta name="description" value="Explore the transformative impact of Declarative Device Management (DDM), Fleet, and osquery for MacAdmins.">
@@ -0,0 +1,134 @@
+# Fleet 4.34.0 | ChromeOS tables, CIS Benchmark load testing.
+
+![Fleet 4.34.0](../website/assets/images/articles/fleet-4.34.0-1600x900@2x.png)
+
+Fleet 4.34.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.33.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+
+* Fleet adds support for ChromeOS
+* Boosted compliance with 'verified' status
+
+
+### Additional tables for ChromeOS
+
+In line with Fleet's value of 🟢 Results, we work relentlessly to enhance your experience. Our aim is to deliver results, focusing on pragmatic and meaningful improvements. With this in mind, we are delighted to introduce new ChromeOS-specific tables: screenlock, system_state, privacy_preferences, and disk_info. These additions not only represent our commitment to iterative progress but also our dedication to enhancing Fleet's utility for managing and understanding your ChromeOS devices better.
+
+
+### Load testing CIS Benchmarks for macOS
+
+Embodying Fleet's values of 🟠 Ownership and 🟢 Results, our team is always ready to tackle challenges head-on for the sake of delivering a reliable and high-performing product. Recently, we pondered the performance impact of running the comprehensive set of 100 CIS Benchmarks for macOS, known colloquially as "eating our own dogfood."
+
+Upon digging deeper, our engineers identified CIS queries 5.1.5, 5.1.6, and 5.1.7 as the three primary outliers in terms of CPU usage and memory footprint. These queries were found to be causing process terminations due to high resource usage.
+
+The queries, which are designed to verify appropriate permissions for system-wide applications (5.1.5) and ensure no world-writable files exist in the System Folder (5.1.6) or Library Folder (5.1.7), had to be refined for efficiency.
+
+With a clear focus on achieving results and owning the challenges we face, this rigorous load testing has led not only to the improvement of the 5.1.5, 5.1.6, and 5.1.7 queries but also to the development of additional tooling for future load testing. This is another stride in our continued effort to enhance Fleet and osquery's performance, reliability, and user experience.
+
+
+## More new features, improvements, and bug fixes
+
+* Added execution of programmatic Windows MDM enrollment on eligible devices when Windows MDM is enabled.
+
+* Microsoft MDM Enrollment Protocol: Added support for the RequestSecurityToken messages.
+
+* Microsoft MDM Enrollment Protocol: Added support for the DiscoveryRequest messages.
+
+* Microsoft MDM Enrollment Protocol: Added support for the GetPolicies messages.
+
+* Added `enabled_windows_mdm` and `disabled_windows_mdm` activities when a user turns on/off Windows MDM.
+
+* Added support to enable and configure Windows MDM and to notify devices that are able to programmatically enroll.
+
+* Added ability to turn Windows MDM on and off from the Fleet UI.
+
+* Added enable and disable Windows MDM activity UI.
+
+* Updated MDM detail query ingestion to switch MDM profiles from "verifying" or "verified" status to "failed" status when osquery reports that this profile is not installed on the host.
+
+* Added notification and execution of programmatic Windows MDM unenrollment on eligible devices when Windows MDM is disabled.
+
+* Added the `FLEET_DEV_MDM_ENABLED` environment variable to enable the Windows MDM feature during its development and beta period.
+
+* Added the `mdm_enabled` feature flag information to the response payload of the `PATCH /config` endpoint.
+
+* When creating a PolicySpec, return the proper HTTP status code if the team is not found.
+
+* Added CPEMatchingRule type, used for correcting false positives caused by incorrect entries in the NVD dataset.
+
+* Optimized macOS CIS query "Ensure Appropriate Permissions Are Enabled for System Wide Applications" (5.1.5).
+
+* Updated macOS CIS policies 5.1.6 and 5.1.7 to use a new fleetd table `find_cmd` instead of relying on the osquery `file` table to improve performance.
+
+* Implemented the privacy_preferences table for the Fleetd Chrome extension.
+
+* Warnings in fleetctl now go to stderr instead of stdout.
+
+* Updated UI for transferred hosts activity items.
+
+* Added Organization support URL input on the setting page organization info form.
+
+* Added improved ABM 400 error message to the UI.
+
+* Hide any osquery tables or columns from Fleet UI that has hidden set to true to match Fleet website.
+
+* Ignore casing in SAML response for display name. For example, the display name attribute can be provided now as `displayname` or `displayName`.
+
+* Provide feedback to users when `fleetctl login` is using EMAIL and PASSWORD environment variables.
+
+* Added a new activity `transferred_hosts` created when hosts are transferred to a new team (or no team).
+
+* Added milliseconds to the timestamp of the auto-generated team name when creating a new team in `GET /mdm/apple/profiles/match`.
+
+* Improved dashboard loading states.
+
+* Improved UI for selecting targets.
+
+* Made sure that all configuration profiles and commands are sent to devices if MDM is turned on, even if the device never turned off MDM.
+
+* Fixed bug when reading FileVault key in osquery and created new Fleet osquery extension table to read the file directly rather than via filelines table.
+
+* Fixed UI bug on host details and device user pages that caused the software search to not work properly when searching by CVE.
+
+* Fixed not validating the schema used in the Metadata URL.
+
+* Fixed improper HTTP status code if SMTP is invalid.
+
+* Fixed false positives for iCloud on macOS.
+
+* Fixed styling of copy message when copying fields.
+
+* Fixed a bug where an empty file uploaded to `POST /api/latest/fleet/mdm/apple/setup/eula` resulted in a 500; now returns a 400 Bad Request.
+
+* Fixed vulnerability dropdown that was hiding if no vulnerabilities.
+
+* Fixed scroll behavior with disk encryption status.
+
+* Fixed empty software image in sandbox mode.
+
+* Fixed improper HTTP status code when `fleet/forgot_password` endpoint is rate limited. 
+
+* Fixed MaxBurst limit parameter for `fleet/forgot_password` endpoint.
+
+* Fixed a bug where reading from the replica would not read recent writes when matching a set of MDM profiles to a team (the `GET /mdm/apple/profiles/match` endpoint).
+
+* Fixed an issue that displayed Nudge to macOS hosts if MDM was configured but MDM features weren't turned on for the host.
+
+* Fixed tooltip word wrapping on the error cell in the macOS settings table.
+
+* Fixed extraneous loading spinner rendering on the software page.
+
+* Fixed styling bug on setup caused by new font being much wider.
+
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.34.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2023-07-12">
+<meta name="articleTitle" value="Fleet 4.34.0 | ChromeOS tables, CIS Benchmark load testing">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.34.0-1600x900@2x.png">
@@ -0,0 +1,49 @@
+# Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023 
+
+[![PSU MacAdmins Conference July 18-21](../website/assets/images/articles/psu-macadmins-conference-2023@2x.png)](https://mdoyvr.com/)
+
+Hello there, macOS admins! Let's talk about the upcoming PSU MacAdmins Conference 2023 (aka Summer Camp for Mac Admins). PSUMAC is July 18-21 at Penn State University. Hope to see you there. 
+
+
+## What's on the agenda?
+
+PSU MacAdmins is not your typical conference. There are loads of technical sessions diving deep into various aspects of macOS administration. You can get your hands dirty with topics like: 
+
+
+* system security—(think password management) 
+* file encryption
+* network security
+* macOS deployment
+* configuration management
+* software delivery
+
+
+And that's not all. There are sessions on managing macOS systems better, where you can learn about user management, group policies, and troubleshooting. Plus, there's plenty of opportunity to explore the latest macOS tools and technologies—ever wanted to get the scoop on Device Management, Munki, or macOS Deployment? Well, now's your chance!
+
+One unique aspect I'm personally excited about is the _Hallway Track_. The hallway track, aka seeing fellow Mac Admins in passing between sessions 🤣, at meals, and at evening events, is a fantastic opportunity to interact with colleagues from different industries and skill levels. What better way to learn than through conversation and shared experiences, right?
+
+And it's not all work and no play. One of the dinners will be on Penn State's Building Business Meadow. I hear there will be various lawn games to play, but no lawn darts 🎯. Penn State's beautiful Arboretum is just across the street and will be open until dusk. Also, don't forget to stop by the [Berkey Creamery](https://creamery.psu.edu/) for a generous scoop of the highest butterfat ice cream 🍨 you will find (and, yes, you can have ice cream shipped home).  
+
+
+## Presenter highlight
+
+I'm excited to say that I'll be sharing some of my experiences at Fleet and beyond in a session on Thursday, July 20, at 9:00 am. My talk, "[Cross-platform open-source monitoring and reporting](https://sched.co/1MmXv)", will focus on how combining Fleet and osquery can provide real-time data from endpoints and proactively trigger support tickets or notifications when a computer encounters issues. It's a topic close to my heart, and I'm eager to share what I've learned.
+
+Another must-see is Greg Neagle's talk at 10:45 am the same day, titled "[The Past, Present, and Future of Munki](https://sched.co/1OIYF)." If you don't know, Greg manages macOS devices at Walt Disney Animation Studios and is the primary developer of Munki. He'll be sharing some fantastic insights into Munki's development journey, its current standing, and where it's headed next. I'm told there'll even be an opportunity for attendees to contribute to Munki's future, so make sure not to miss it!
+
+
+## Come say hi to Fleet (and get some cool swag)
+
+Here at Fleet, we're super excited to be sponsoring this conference. Supporting the MacAdmin community is what we're all about. Not only are we sponsoring the conference, but we're also backing Greg's presentation. Don't forget to swing by our booth—we've got some fun stickers and swag you might like!
+
+In a nutshell, the [PSU MacAdmins Conference 2023](https://macadmins.psu.edu/) is shaping up to be an event packed with valuable insights and networking opportunities. I'm excited to see all of you there, and here's to learning and growing together in our macOS admin journey!
+
+
+
+<meta name="category" value="announcements">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="authorFullName" value="JD Strong">
+<meta name="publishedOn" value="2023-07-13">
+<meta name="articleTitle" value="Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023">
+<meta name="articleImageUrl" value="../website/assets/images/articles/psu-macadmins-conference-2023@2x.png">
+<meta name="description" value="A look ahead to PSU MacAdmin Conference July 18-21, 2023">
@@ -1 +0,0 @@
-* Optimize macOS CIS query "Ensure Appropriate Permissions Are Enabled for System Wide Applications" (5.1.5).
@@ -1 +0,0 @@
-* Implement the privacy_preferences table for the Fleetd Chrome extension
@@ -1 +0,0 @@
- Fix a bug where an extraneous loading spinner was rendered on the Software page.
@@ -1 +0,0 @@
- Hide any osquery tables or columns from Fleet UI that has hidden set to true to match Fleet website
@@ -1,3 +0,0 @@
- Added CPEMatchingRule type, used for correcting false positives caused by incorrect entries in the
-  NVD dataset.
- Fixed false positives for iCloud on macOS.
@@ -1 +0,0 @@
-Fix styling bug on setup caused by new font being much wider
@@ -1 +0,0 @@
- Fix styling of copy message when copying fields
@@ -0,0 +1,2 @@
+- If a policy was defined with an invalid query, the desktop endpoint should count that policy as a
+  failed policy.
@@ -0,0 +1 @@
+* Improve the reporting of the puppet module to only report as changed profiles that actually changed during a run.
@@ -0,0 +1 @@
+* Improved delivery of Apple MDM profiles by not re-sending `InstallProfile` commands if a host switches teams but the profile contents are the same.
@@ -0,0 +1 @@
+* Changed how team assignment works for the Puppet module, for more details see the [README](https://github.com/fleetdm/fleet/blob/main/ee/tools/puppet/fleetdm/README.md)
@@ -0,0 +1 @@
+- Updated server logging for webhook requests to mask URL query values if the query param name includes "secret", "token", "key", "password".
@@ -1 +0,0 @@
-* Fixed an issue that displayed Nudge to macOS hosts if MDM was configured but MDM features weren't turned on for the host
@@ -0,0 +1 @@
+* Set `DeferForceAtUserLoginMaxBypassAttempts` to `1` in the default FileVault profile installed by Fleet.
@@ -1,3 +0,0 @@
- If the `fleet/forgot_password` endpoint is rate limited it should return the proper HTTP status
-  code.
- Fixed MaxBurst limit parameter for `fleet/forgot_password` endpoint.
@@ -1 +0,0 @@
- Warnings in fleetctl should go to stderr instead of stdout.
@@ -1 +0,0 @@
- Fix vuln dropdown that was hiding if no vulnerabilities
@@ -1 +0,0 @@
-Cleaner UI for selecting targets
@@ -1 +0,0 @@
- Fix funky scroll behavior with disk encryption status
@@ -1 +0,0 @@
- Fix empty software image in sandbox mode
@@ -1 +0,0 @@
- Clean up dashboard loading states
@@ -1 +0,0 @@
-* Fixed a bug where an empty file uploaded to `POST /api/latest/fleet/mdm/apple/setup/eula` resulted in a 500, now returns a 400 Bad Request.
@@ -1 +0,0 @@
- Don't use the MSRC scanner on non-windows OS.
@@ -1 +0,0 @@
- When creating a PolicySpec, return the proper HTTP status code if the Team is not found.
@@ -1 +0,0 @@
- Return the proper HTTP status code if SMTP is invalid.
@@ -1 +0,0 @@
- When setting up SSO, validate the scheme used in the Metadata URL
@@ -1 +0,0 @@
-* Added the `mdm_enabled` feature flag information to the response payload of the `PATCH /config` endpoint.
@@ -0,0 +1 @@
+- UI Fix: Observer + should be able to run any query by clicking create new query
@@ -1,2 +0,0 @@
- Fixed bug when reading filevault key in osquery and created new Fleet osquery
-  extension table to read the file directly rather than via filelines table.
@@ -1 +0,0 @@
- add improved ABM 400 error message to the UI
@@ -1 +0,0 @@
- add ability to turn windows mdm on and off from the fleet UI
@@ -0,0 +1 @@
+- add dark and light mode logo uploads and show the appropriate logo to the macOS mdm migration flow
@@ -1 +0,0 @@
-* Added a new activity `transferred_hosts` created when hosts are transferred to a new team (or no team).
@@ -0,0 +1 @@
+- update macos mdm setup UI in fleet UI
@@ -1 +0,0 @@
-* Added the `FLEET_DEV_MDM_ENABLED` environment variable to enable the Windows MDM feature during its development and beta period.
@@ -1 +0,0 @@
-* Added support to enable and configure Windows MDM and to notify devices that are able to programmatically enroll.
@@ -1 +0,0 @@
-* Added execution of programmatic Windows MDM enrollment on eligible devices when Windows MDM is enabled.
@@ -1 +0,0 @@
-* Microsoft MDM Enrollment Protocol: Added support for the DiscoveryRequest messages
@@ -1 +0,0 @@
-* Microsoft MDM Enrollment Protocol: Added support for the GetPolicies messages
@@ -1 +0,0 @@
-* Microsoft MDM Enrollment Protocol: Added support for the RequestSecurityToken messages
@@ -1 +0,0 @@
-* Added `enabled_windows_mdm` and `disabled_windows_mdm` activities when a user turns on/off Windows MDM.
@@ -1 +0,0 @@
- add enable and disable windows mdm activity UI
@@ -1 +0,0 @@
- Updated UI for transferred hosts activity items.
@@ -1,2 +0,0 @@
- Updated MDM detail query ingestion to switch MDM profiles from "verifying" or "verified"
-  status to "failed" status when osquery reports that this profile is not installed on the host.
@@ -1 +0,0 @@
-* Added notification and execution of programmatic Windows MDM unenrollment on eligible devices when Windows MDM is disabled.
@@ -1,2 +0,0 @@
-* Fixed a bug where reading from the replica would not read recent writes when matching a set of MDM profiles to a team (the `GET /mdm/apple/profiles/match` endpoint).
-* Added milliseconds to the timestamp of auto-generated team name when creating a new team in `GET /mdm/apple/profiles/match`.
@@ -1 +0,0 @@
- fix tooltip word wrapping on the error cell in the macOS settings table
@@ -0,0 +1 @@
+- Updated ingestion of host detail queries for MDM so hosts that report empty results are counted as "Off".
@@ -1 +0,0 @@
- add Organization support URL input on the setting page Organization info form.
@@ -1,2 +0,0 @@
- Fixed UI bug on host details and device user pages that caused the software search to not work
-  properly when searching by CVE.
@@ -0,0 +1 @@
+* Add MSI installer deployement support through MS-MDM
@@ -0,0 +1 @@
+* Adding support for MDM TOS endpoint 
@@ -0,0 +1 @@
+* Adding support for Azure JWT tokens
@@ -0,0 +1 @@
+* Adding support for Windows MDM STS Auth Endpoint
@@ -1 +0,0 @@
-* Make sure that all configuration profiles and commands are sent to devices if MDM is turned on, even if the device never turned off MDM.
@@ -1 +0,0 @@
-* Provide feedback to users when `fleetctl login` is using EMAIL and PASSWORD environment variables.
@@ -1 +0,0 @@
- Ignore casing in SAML response for display name. For example the display name attribute can be provided now as `displayname` or `displayName`.
@@ -1 +0,0 @@
-* For performance reasons, update macOS CIS policies 5.1.6 and 5.1.7 to use a new fleetd table `find_cmd` instead of relying on the osquery `file` table.
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`* Optimize macOS CIS query "Ensure Appropriate Permissions Are Enabled for System Wide Applications" (5.1.5).`
				`@@ -1 +0,0 @@`
				`* Implement the privacy_preferences table for the Fleetd Chrome extension`
				`@@ -1 +0,0 @@`
				`- Fix a bug where an extraneous loading spinner was rendered on the Software page.`
				`@@ -1 +0,0 @@`
				`- Hide any osquery tables or columns from Fleet UI that has hidden set to true to match Fleet website`
				`@@ -1 +0,0 @@`
				`Fix styling bug on setup caused by new font being much wider`
				`@@ -1 +0,0 @@`
				`- Fix styling of copy message when copying fields`
				`@@ -0,0 +1 @@`
				`* Improve the reporting of the puppet module to only report as changed profiles that actually changed during a run.`
				`@@ -0,0 +1 @@`
				* Improved delivery of Apple MDM profiles by not re-sending `InstallProfile` commands if a host switches teams but the profile contents are the same.
				`@@ -0,0 +1 @@`
				`* Changed how team assignment works for the Puppet module, for more details see the [README](https://github.com/fleetdm/fleet/blob/main/ee/tools/puppet/fleetdm/README.md)`
				`@@ -0,0 +1 @@`
				`- Updated server logging for webhook requests to mask URL query values if the query param name includes "secret", "token", "key", "password".`