diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 9dfe4c2f62..683c406eb0 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -7,7 +7,7 @@ on:
jobs:
build:
if: ${{ github.repository == 'fleetdm/fleet' }}
-
+
runs-on: ubuntu-latest
strategy:
@@ -49,14 +49,15 @@ jobs:
# Run sanity checks
- run: cd website/ && npm test
- # Compile assets
+ # Compile browser assets & markdown content into generated collateral
- run: cd website/ && npm run build-for-prod
- # Commit newly-built assets locally so we can push them to Heroku below.
+ # Commit newly-generated collateral locally so we can push them to Heroku below.
# (This commit will never be pushed to GitHub- only to Heroku.)
# > The local config flags make this work in GitHub's environment.
- run: git add website/.www
- - run: git -c "user.name=Fleetwood" -c "user.email=github@example.com" commit -am 'AUTOMATED COMMIT - Deployed the latest, including modified HTML layouts and .sailsrc file that reference minified assets.'
+ - run: git add -f website/views/partials/built-from-markdown # « for new HTML files compiled from markdown content
+ - run: git -c "user.name=Fleetwood" -c "user.email=github@example.com" commit -am 'AUTOMATED COMMIT - Deployed the latest, including generated collateral such as compiled documentation, modified HTML layouts, and a .sailsrc file that references minified client-side code assets.'
# Configure the Heroku app we'll be deploying to
- run: heroku git:remote -a production-fleetdm-website
diff --git a/.github/workflows/markdown-link-check-config.json b/.github/workflows/markdown-link-check-config.json
index 470c4b521d..e7d33f6cbf 100644
--- a/.github/workflows/markdown-link-check-config.json
+++ b/.github/workflows/markdown-link-check-config.json
@@ -23,6 +23,9 @@
},
{
"pattern": "github.com/fleetdm/confidential"
+ },
+ {
+ "pattern": "osquery.io/schema"
}
],
"retryOn429": true,
diff --git a/.gitignore b/.gitignore
index fe0513dee2..20f75d9f03 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,7 @@ cypress/downloads
# Fleet local development DB backups
backup.sql.gz
+
+# Common mistake for new developers to run npm install and then end up
+# committing a package-lock.json. Fleet app uses Yarn with yarn.lock.
+package-lock.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4d34818ed..f0ecea52e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,22 @@
+## Fleet 3.12.0 (May 19, 2021)
+
+* Add scheduled queries to the _Host details_ page. Surface the "Name", "Description", "Frequency", and "Last run" information for each query in a pack that apply to a specific host.
+
+* Improve the freshness of host vitals by adding the ability to "refetch" the data on the _Host details_ page.
+
+* Add ability to copy log fields into Google Cloud Pub/Sub attributes. This allows users to use these values for subscription filters.
+
+* Add ability to duplicate live query results in Redis. When the `redis_duplicate_results` configuration option is set to `true`, all live query results will be copied to an additional Redis Pub/Sub channel named LQDuplicate.
+
+* Add ability to controls the server-side HTTP keepalive property. Turning off keepalives has helped reduce outstanding TCP connections in some deployments.
+
+* Fix an issue on the _Packs_ page in which Fleet would incorrectly handle the configured `server_url_prefix`.
+
## Fleet 3.11.0 (Apr 28, 2021)
* Improve Fleet performance by batch updating host seen time instead of updating synchronously. This improvement reduces MySQL CPU usage by ~33% with 4,000 simulated hosts and MySQL running in Docker.
-* Add support for software inventory, introducing a list of installed software items on each host's respective _Host details_ page. This feature is flagged off by default (for now). Check out [the feature flag documentation for instructions on how to turn this feature on](./docs/2-Deployment/2-Configuration.md#software-inventory).
+* Add support for software inventory, introducing a list of installed software items on each host's respective _Host details_ page. This feature is flagged off by default (for now). Check out [the feature flag documentation for instructions on how to turn this feature on](https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/2-Configuration.md#software-inventory).
* Add Windows support for `fleetctl` agent autoupdates. The `fleetctl updates` command provides the ability to self-manage an agent update server. Available for Fleet Basic customers.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index fe194fc8d6..64b8de7bde 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -33,3 +33,23 @@ To open your browser's **network requests**, press Control Shift J (Windows, Lin
Sensitive security-related issues should be reported to
[security@fleetdm.com](mailto:security@fleetdm.com) before a public issue is made.
+
+## Contributing to documentation
+
+Fleet currently uses GitHub as the central location for documentation.
+
+### Markdown links
+
+Due to the structure of the Fleet documentation and GitHub's unique markdown files, there are several practices we'd like to call out if you're documentation changes include links to other locations within the Fleet docs.
+
+#### Relative links
+
+When including a link to a different file in the Fleet documentation please use relative links when possible.
+
+For example, let's say you're working on changes in the Contribution docs and you'd like to add a link to the REST API docs. The relative link would look something like `../1-Using-Fleet/3-REST-API.md`.
+
+#### Special characters in anchor links
+
+There are certain characters GitHub doesn't support in the use of anchor links in markdown files. The general rule we've found is to only use a-z or A-Z characters in anchor links. All other characters should be removed.
+
+For example, consider the section title *How do I connect to the Mailhog simulated server?*. The valid GitHub anchor link for this section is #how-do-i-connect-to-the-mailhog-simulated-server. Notice the *?* character is removed.
diff --git a/README.md b/README.md
index 37e044d4d0..fc82ef88ca 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-
+
#### [Website](https://fleetdm.com/) [News](http://twitter.com/fleetctl) [Report a bug](https://github.com/fleetdm/fleet/issues/new)
@@ -13,7 +13,7 @@ Fleet is the most widely used open source osquery manager. Deploying osquery wi
```bash
# Install the Fleet command-line tool
-npm install -g fleetctl
+sudo npm install -g fleetctl
# Run a local demo of the Fleet server
sudo fleetctl preview
```
@@ -47,6 +47,10 @@ Documentation for Fleet can be found [here on GitHub](./docs/README.md).
Please join us in the #fleet channel on [osquery Slack](https://osquery.slack.com/join/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw#/).
+#### Contributing
+
+Contributions are welcome, whether you answer questions on Slack/GitHub/StackOverflow/Twitter, improve the documentation or website, write a tutorial, give a talk, start a local osquery meetup, troubleshoot reported issues, or [submit a patch](https://github.com/fleetdm/fleet/blob/master/CONTRIBUTING.md). The Fleet code of conduct is [on GitHub](https://github.com/fleetdm/fleet/blob/master/CODE_OF_CONDUCT.md).
+
#### Community projects
Below are some projects created by Fleet community members. Please submit a pull request if you'd like your project featured.
diff --git a/assets/images/icon-accordion-collapse-16x16@2x.png b/assets/images/icon-accordion-collapse-16x16@2x.png
new file mode 100644
index 0000000000..1234f114dd
Binary files /dev/null and b/assets/images/icon-accordion-collapse-16x16@2x.png differ
diff --git a/assets/images/icon-accordion-collapse-black-16x16@2x.png b/assets/images/icon-accordion-collapse-black-16x16@2x.png
new file mode 100644
index 0000000000..d89ec4e652
Binary files /dev/null and b/assets/images/icon-accordion-collapse-black-16x16@2x.png differ
diff --git a/assets/images/icon-accordion-collapse-blue-16x16@2x.png b/assets/images/icon-accordion-collapse-blue-16x16@2x.png
new file mode 100644
index 0000000000..d89ec4e652
Binary files /dev/null and b/assets/images/icon-accordion-collapse-blue-16x16@2x.png differ
diff --git a/assets/images/icon-chevron-black-16x16@2x.png b/assets/images/icon-chevron-black-16x16@2x.png
new file mode 100644
index 0000000000..bc37f8848b
Binary files /dev/null and b/assets/images/icon-chevron-black-16x16@2x.png differ
diff --git a/assets/images/icon-chevron-black-9x6@2x.png b/assets/images/icon-chevron-black-9x6@2x.png
new file mode 100644
index 0000000000..58e9f47f74
Binary files /dev/null and b/assets/images/icon-chevron-black-9x6@2x.png differ
diff --git a/assets/images/icon-chevron-blue-16x16@2x.png b/assets/images/icon-chevron-blue-16x16@2x.png
new file mode 100644
index 0000000000..121e004fcf
Binary files /dev/null and b/assets/images/icon-chevron-blue-16x16@2x.png differ
diff --git a/assets/images/icon-chevron-blue-9x6@2x.png b/assets/images/icon-chevron-blue-9x6@2x.png
new file mode 100644
index 0000000000..a633a5ec4b
Binary files /dev/null and b/assets/images/icon-chevron-blue-9x6@2x.png differ
diff --git a/assets/images/icon-chevron-down-9x6@2x.png b/assets/images/icon-chevron-down-9x6@2x.png
new file mode 100644
index 0000000000..46c0151dfe
Binary files /dev/null and b/assets/images/icon-chevron-down-9x6@2x.png differ
diff --git a/assets/images/icon-chevron-purple-9x6@2x.png b/assets/images/icon-chevron-purple-9x6@2x.png
new file mode 100644
index 0000000000..32f1662b7e
Binary files /dev/null and b/assets/images/icon-chevron-purple-9x6@2x.png differ
diff --git a/assets/images/icon-chevron-white-16x16@2x.png b/assets/images/icon-chevron-white-16x16@2x.png
new file mode 100644
index 0000000000..1f6b4cfe43
Binary files /dev/null and b/assets/images/icon-chevron-white-16x16@2x.png differ
diff --git a/assets/images/icon-chevron-white-9x6@2x.png b/assets/images/icon-chevron-white-9x6@2x.png
new file mode 100644
index 0000000000..71f774b722
Binary files /dev/null and b/assets/images/icon-chevron-white-9x6@2x.png differ
diff --git a/assets/images/icon-close-8x8@2x.png b/assets/images/icon-close-8x8@2x.png
new file mode 100644
index 0000000000..22fc241309
Binary files /dev/null and b/assets/images/icon-close-8x8@2x.png differ
diff --git a/assets/images/icon-close-fleet-blue-16x16@2x.png b/assets/images/icon-close-fleet-blue-16x16@2x.png
new file mode 100644
index 0000000000..2e5c63aef2
Binary files /dev/null and b/assets/images/icon-close-fleet-blue-16x16@2x.png differ
diff --git a/assets/images/icon-close-vibrant-blue-16x16@2x.png b/assets/images/icon-close-vibrant-blue-16x16@2x.png
new file mode 100644
index 0000000000..fdaaae88d2
Binary files /dev/null and b/assets/images/icon-close-vibrant-blue-16x16@2x.png differ
diff --git a/assets/images/icon-collapse-black-16x16@2x.png b/assets/images/icon-collapse-black-16x16@2x.png
new file mode 100644
index 0000000000..d89ec4e652
Binary files /dev/null and b/assets/images/icon-collapse-black-16x16@2x.png differ
diff --git a/assets/images/icon-collapse-blue-16x16@2x.png b/assets/images/icon-collapse-blue-16x16@2x.png
new file mode 100644
index 0000000000..d89ec4e652
Binary files /dev/null and b/assets/images/icon-collapse-blue-16x16@2x.png differ
diff --git a/assets/images/icon-plus-circle-16x16@2x.png b/assets/images/icon-plus-circle-16x16@2x.png
new file mode 100644
index 0000000000..8f1b4475f6
Binary files /dev/null and b/assets/images/icon-plus-circle-16x16@2x.png differ
diff --git a/assets/images/icon-refetch-12x12@2x.png b/assets/images/icon-refetch-12x12@2x.png
new file mode 100644
index 0000000000..960ea80732
Binary files /dev/null and b/assets/images/icon-refetch-12x12@2x.png differ
diff --git a/assets/images/icon-refetch-36x36@2x.png b/assets/images/icon-refetch-36x36@2x.png
new file mode 100644
index 0000000000..185a15aa21
Binary files /dev/null and b/assets/images/icon-refetch-36x36@2x.png differ
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index ca00e5a206..f7b228edfc 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -4,8 +4,8 @@ name: fleet
keywords:
- fleet
- osquery
-version: 3.11.0
+version: 3.12.0
home: https://github.com/fleetdm/fleet
sources:
- https://github.com/fleetdm/fleet.git
-appVersion: 3.11.0
+appVersion: 3.12.0
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index 2ff8623990..8ee9bf995c 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -2,7 +2,7 @@
# All settings related to how Fleet is deployed in Kubernetes
hostName: fleet.localhost
replicas: 3 # The number of Fleet instances to deploy
-imageTag: 3.11.0 # Version of Fleet to deploy
+imageTag: 3.12.0 # Version of Fleet to deploy
createIngress: true # Whether or not to automatically create an Ingress
ingressAnnotations: {} # Additional annotation to add to the Ingress
podAnnotations: {} # Additional annotations to add to the Fleet pod
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index 3c931cf5d6..bfd72636ca 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -216,7 +216,7 @@ the way that the Fleet server works.
}
redisPool := pubsub.NewRedisPool(config.Redis.Address, config.Redis.Password, config.Redis.Database, config.Redis.UseTLS)
- resultStore := pubsub.NewRedisQueryResults(redisPool)
+ resultStore := pubsub.NewRedisQueryResults(redisPool, config.Redis.DuplicateResults)
liveQueryStore := live_query.NewRedisLiveQuery(redisPool)
ssoSessionStore := sso.NewSessionStore(redisPool)
@@ -368,6 +368,7 @@ the way that the Fleet server works.
IdleTimeout: 5 * time.Minute,
MaxHeaderBytes: 1 << 18, // 0.25 MB (262144 bytes)
}
+ srv.SetKeepAlivesEnabled(config.Server.Keepalive)
errs := make(chan error, 2)
go func() {
if !config.Server.TLS {
diff --git a/docs/1-Using-Fleet/2-fleetctl-CLI.md b/docs/1-Using-Fleet/2-fleetctl-CLI.md
index 79c79773da..2ddba8aeaf 100644
--- a/docs/1-Using-Fleet/2-fleetctl-CLI.md
+++ b/docs/1-Using-Fleet/2-fleetctl-CLI.md
@@ -34,7 +34,7 @@ This guide illustrates:
### Running Fleet
-For the sake of this tutorial, I will be using the local development Docker Compose infrastructure to run Fleet locally. This is documented in some detail in the [developer documentation](../3-Contribution/1-Building-Fleet.md#development-infrastructure), but the following are the minimal set of commands that you can run from the root of the repository (assuming that you have a working Go/JavaScript toolchain installed along with Docker Compose):
+For the sake of this tutorial, I will be using the local development Docker Compose infrastructure to run Fleet locally. This is documented in some detail in the [developer documentation](../4-Contribution/1-Building-Fleet.md#development-infrastructure), but the following are the minimal set of commands that you can run from the root of the repository (assuming that you have a working Go/JavaScript toolchain installed along with Docker Compose):
```
docker-compose up -d
@@ -80,7 +80,7 @@ It's possible to specify the password via the `--password` flag or the `$PASSWOR
### Connecting a host
-For the sake of this tutorial, I'm going to be using Kolide's osquery launcher to start osquery locally and connect it to Fleet. To learn more about connecting osquery to Fleet, see the [Adding Hosts to Fleet](../2-Deployment/3-Adding-hosts.md) documentation.
+For the sake of this tutorial, I'm going to be using Kolide's osquery launcher to start osquery locally and connect it to Fleet. To learn more about connecting osquery to Fleet, see the [Adding Hosts to Fleet](../3-Deployment/3-Adding-hosts.md) documentation.
To get your osquery enroll secret, run the following:
@@ -211,30 +211,7 @@ Note the token can also be set with `fleetctl config set --token`, but this may
## Using fleetctl for configuration
-A Fleet configuration is defined using one or more declarative "messages" in yaml syntax. Each message can live in it's own file or multiple in one file, each separated by `---`. Each file/message contains a few required top-level keys:
-
-- `apiVersion` - the API version of the file/request
-- `spec` - the "data" of the request
-- `kind ` - the type of file/object (i.e.: pack, query, config)
-
-The file may optionally also include some `metadata` for more complex data types (i.e.: packs).
-
-When you reason about how to manage these config files, consider following the [General Config Tips](https://kubernetes.io/docs/concepts/configuration/overview/#general-config-tips) published by the Kubernetes project. Some of the especially relevant tips are included here as well:
-
-- When defining configurations, specify the latest stable API version.
-- Configuration files should be stored in version control before being pushed to the cluster. This allows quick roll-back of a configuration if needed. It also aids with cluster re-creation and restoration if necessary.
-- Group related objects into a single file whenever it makes sense. One file is often easier to manage than several. See the [config-single-file.yml](../../examples/config-single-file.yml) file as an example of this syntax.
-- Don’t specify default values unnecessarily – simple and minimal configs will reduce errors.
-
-All of these files can be concatenated together into [one file](../../examples/config-single-file.yml) (separated by `---`), or they can be in [individual files with a directory structure](../../examples/config-many-files) like the following:
-
-```
-|-- config.yml
-|-- labels.yml
-|-- packs
-| `-- osquery-monitoring.yml
-`-- queries.yml
-```
+A Fleet configuration is defined using one or more declarative "messages" in yaml syntax. Check out the [configuration files](./configuration-files/README.md) section of the documentation for example yaml files.
### Convert osquery JSON
@@ -577,7 +554,7 @@ spec:
Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from osquery agents, returning the full contents to Fleet.
-File carving data can be either stored in Fleet's database or to an external S3 bucket. For information on how to configure the latter, consult the [configuration docs](../2-Deployment/2-Configuration.md#s3-file-carving-backend).
+File carving data can be either stored in Fleet's database or to an external S3 bucket. For information on how to configure the latter, consult the [configuration docs](https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/2-Configuration.md#s3-file-carving-backend).
### Configuration
diff --git a/docs/1-Using-Fleet/3-REST-API.md b/docs/1-Using-Fleet/3-REST-API.md
index af8001efca..25e9e68018 100644
--- a/docs/1-Using-Fleet/3-REST-API.md
+++ b/docs/1-Using-Fleet/3-REST-API.md
@@ -1,4 +1,5 @@
# REST API
+
- [Overview](#overview)
- [fleetctl](#fleetctl)
- [Current API](#current-api)
@@ -23,8 +24,8 @@ Fleet is powered by a Go API server which serves three types of endpoints:
- All other endpoints are served by the React single page application bundle.
The React app uses React Router to determine whether or not the URI is a valid
route and what to do.
-
-Note: We have deprecated `/api/v1/kolide/` routes and will remove them in the Fleet 4.0 release. Please migrate all routes to `/api/v1/fleet/`.
+
+Note: We have deprecated `/api/v1/kolide/` routes and will remove them in the Fleet 4.0 release. Please migrate all routes to `/api/v1/fleet/`.
### fleetctl
@@ -51,8 +52,6 @@ Queries, packs, scheduled queries, labels, invites, users, sessions all behave t
All of these objects are put together and distributed to the appropriate osquery agents at the appropriate time. At this time, the best source of truth for the API is the [HTTP handler file](https://github.com/fleetdm/fleet/blob/master/server/service/handler.go) in the Go application. The REST API is exposed via a transport layer on top of an RPC service which is implemented using a micro-service library called [Go Kit](https://github.com/go-kit/kit). If using the Fleet API is important to you right now, being familiar with Go Kit would definitely be helpful.
-
-
## Authentication
- [Log in](#log-in)
@@ -94,7 +93,7 @@ Then, use that API token to authenticate all subsequent API requests by sending
Authorization: Bearer
```
-> For SSO users, username/password login is disabled. The API token can instead be retrieved from the "Settings" page in the UI.
+> For SSO users, username/password login is disabled. The API token can instead be retrieved from the "Settings" page in the UI.
### Log in
@@ -263,11 +262,11 @@ Resets a user's password. Which user is determined by the password reset token u
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| new_password | string | body | **Required**. The new password. |
-| new_password_confirmation | string | body | **Required**. Confirmation for the new password. |
-| password_reset_token | string | body | **Required**. The token provided to the user in the password reset email. |
+| Name | Type | In | Description |
+| ------------------------- | ------ | ---- | ------------------------------------------------------------------------- |
+| new_password | string | body | **Required**. The new password. |
+| new_password_confirmation | string | body | **Required**. Confirmation for the new password. |
+| password_reset_token | string | body | **Required**. The token provided to the user in the password reset email. |
#### Example
@@ -401,8 +400,8 @@ Gets the current SSO configuration.
#### Parameters
-| Name | Type | In | Description |
-| --------- | ------ | ---- | -------------------------------------------------------------------------- |
+| Name | Type | In | Description |
+| --------- | ------ | ---- | --------------------------------------------------------------------------- |
| relay_url | string | body | **Required**. The relative url to be navigated to after successful sign in. |
#### Example
@@ -445,8 +444,8 @@ This is the callback endpoint that the identity provider will use to send securi
#### Parameters
-| Name | Type | In | Description |
-| --------- | ------ | ---- | -------------------------------------------------------------------------- |
+| Name | Type | In | Description |
+| ------------ | ------ | ---- | ----------------------------------------------------------- |
| SAMLResponse | string | body | **Required**. The SAML response from the identity provider. |
#### Example
@@ -478,6 +477,7 @@ This is the callback endpoint that the identity provider will use to send securi
- [Get host](#get-host)
- [Get host by identifier](#get-host-by-identifier)
- [Delete host](#delete-host)
+- [Refetch host](#refetch-host)
### List hosts
@@ -485,14 +485,14 @@ This is the callback endpoint that the identity provider will use to send securi
#### Parameters
-| Name | Type | In | Description |
-| ----------------------- | ------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| page | integer | query | Page number of the results to fetch. |
-| per_page | integer | query | Results per page. |
-| order_key | string | query | What to order results by. Can be any column in the hosts table. |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
-| status | string | query | Indicates the status of the hosts to return. Can either be `new`, `online`, `offline`, or `mia`. |
-| query | string | query | Search query keywords. Searchable fields include `hostname`, `machine_serial`, `uuid`, and `ipv4`. |
+| Name | Type | In | Description |
+| ----------------------- | ------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| page | integer | query | Page number of the results to fetch. |
+| per_page | integer | query | Results per page. |
+| order_key | string | query | What to order results by. Can be any column in the hosts table. |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| status | string | query | Indicates the status of the hosts to return. Can either be `new`, `online`, `offline`, or `mia`. |
+| query | string | query | Search query keywords. Searchable fields include `hostname`, `machine_serial`, `uuid`, and `ipv4`. |
| additional_info_filters | string | query | A comma-delimited list of fields to include in each host's additional information object. See [Fleet Configuration Options](https://github.com/fleetdm/fleet/blob/master/docs/1-Using-Fleet/2-fleetctl-CLI.md#fleet-configuration-options) for an example configuration with hosts' additional information. |
#### Example
@@ -571,7 +571,6 @@ None.
`GET /api/v1/fleet/host_summary`
-
##### Default response
`Status: 200`
@@ -587,23 +586,22 @@ None.
### Get host
-Returns the information of the specified host.
+Returns the information of the specified host.
-The endpoint returns the host's installed `software` if the software inventory feature flag is turned on. This feature flag is turned off by default. [Check out the feature flag documentation](../2-Deployment/2-Configuration.md#feature-flags) for instructions on how to turn on the software inventory feature.
+The endpoint returns the host's installed `software` if the software inventory feature flag is turned on. This feature flag is turned off by default. [Check out the feature flag documentation](../3-Deployment/2-Configuration.md#feature-flags) for instructions on how to turn on the software inventory feature.
`GET /api/v1/fleet/hosts/{id}`
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The host's id. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
+| id | integer | path | **Required**. The host's id. |
#### Example
`GET /api/v1/fleet/hosts/121`
-
##### Default response
`Status: 200`
@@ -704,15 +702,14 @@ Returns the information of the host specified using the `uuid`, `osquery_host_id
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| identifier | integer or string | path | **Required**. The host's `uuid`, `osquery_host_id`, `hostname`, or `node_key`|
+| Name | Type | In | Description |
+| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- |
+| identifier | integer or string | path | **Required**. The host's `uuid`, `osquery_host_id`, `hostname`, or `node_key` |
#### Example
`GET /api/v1/fleet/hosts/identifier/f01c4390-0000-0000-a1e5-14346a5724dc`
-
##### Default response
`Status: 200`
@@ -768,14 +765,37 @@ Deletes the specified host from Fleet. Note that a deleted host will fail authen
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The host's id. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
+| id | integer | path | **Required**. The host's id. |
#### Example
`DELETE /api/v1/fleet/hosts/121`
+##### Default response
+
+`Status: 200`
+
+```
+{}
+```
+
+### Refetch host
+
+Flags the host details to be refetched the next time the host checks in for live queries. Note that we cannot be certain when the host will actually check in and update these details. Further requests to the host APIs will indicate that the refetch has been requested through the `refetch_requested` field on the host object.
+
+`POST /api/v1/fleet/hosts/{id}/refetch`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
+| id | integer | path | **Required**. The host's id. |
+
+#### Example
+
+`POST /api/v1/fleet/hosts/121/refetch`
##### Default response
@@ -808,12 +828,12 @@ Creates a dynamic label.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| name | string | body | **Required**. The label's name. |
-| description | string | body | The label's description. |
-| query | string | body | **Required**. The query in SQL syntax used to filter the hosts. |
-| platform | string | body | The specific platform for the label to target. Provides an additional filter. Choices for platform are `darwin`, `windows`, `ubuntu`, and `centos`. All platforms are included by default and this option is represented by an empty string.|
+| Name | Type | In | Description |
+| ----------- | ------ | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| name | string | body | **Required**. The label's name. |
+| description | string | body | The label's description. |
+| query | string | body | **Required**. The query in SQL syntax used to filter the hosts. |
+| platform | string | body | The specific platform for the label to target. Provides an additional filter. Choices for platform are `darwin`, `windows`, `ubuntu`, and `centos`. All platforms are included by default and this option is represented by an empty string. |
#### Example
@@ -860,12 +880,12 @@ Modifies the specified label. Note: Label queries are immutable. To change the q
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The label's id. |
-| name | string | body | The label's name. |
-| description | string | body | The label's description. |
-| platform | string | body | The specific platform for the label to target. Provides an additional filter. Choices for platform are `darwin`, `windows`, `ubuntu`, and `centos`. All platforms are included by default and this option is represented by an empty string.|
+| Name | Type | In | Description |
+| ----------- | ------- | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| id | integer | path | **Required**. The label's id. |
+| name | string | body | The label's name. |
+| description | string | body | The label's description. |
+| platform | string | body | The specific platform for the label to target. Provides an additional filter. Choices for platform are `darwin`, `windows`, `ubuntu`, and `centos`. All platforms are included by default and this option is represented by an empty string. |
#### Example
@@ -912,9 +932,9 @@ Returns the specified label.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The label's id. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ----------------------------- |
+| id | integer | path | **Required**. The label's id. |
#### Example
@@ -950,11 +970,11 @@ Returns a list of all the labels in Fleet.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The label's id. |
-| order_key | string | query | What to order results by. Can be any column in the labels table. |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| Name | Type | In | Description |
+| --------------- | ------- | ----- | ----------------------------------------------------------------------------------------------------------------------------- |
+| id | integer | path | **Required**. The label's id. |
+| order_key | string | query | What to order results by. Can be any column in the labels table. |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
#### Example
@@ -1051,12 +1071,12 @@ Returns a list of the hosts that belong to the specified label.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The label's id. |
-| order_key | string | query | What to order results by. Can be any column in the hosts table. |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
-| query | string | query | Search query keywords. Searchable fields include `hostname`, `machine_serial`, `uuid`, and `ipv4`. |
+| Name | Type | In | Description |
+| --------------- | ------- | ----- | ----------------------------------------------------------------------------------------------------------------------------- |
+| id | integer | path | **Required**. The label's id. |
+| order_key | string | query | What to order results by. Can be any column in the hosts table. |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| query | string | query | Search query keywords. Searchable fields include `hostname`, `machine_serial`, `uuid`, and `ipv4`. |
#### Example
@@ -1119,9 +1139,9 @@ Deletes the label specified by name.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| name | string | path | **Required**. The label's name. |
+| Name | Type | In | Description |
+| ---- | ------ | ---- | ------------------------------- |
+| name | string | path | **Required**. The label's name. |
#### Example
@@ -1143,9 +1163,9 @@ Deletes the label specified by ID.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| id | integer | path | **Required**. The label's id. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ----------------------------- |
+| id | integer | path | **Required**. The label's id. |
#### Example
@@ -1171,9 +1191,9 @@ If the `label_membership_type` is set to `manual`, the `hosts` property must als
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| specs | list | path | A list of the label to apply. Each label requires the `name`, `query`, and `label_membership_type` properties|
+| Name | Type | In | Description |
+| ----- | ---- | ---- | ------------------------------------------------------------------------------------------------------------- |
+| specs | list | path | A list of the label to apply. Each label requires the `name`, `query`, and `label_membership_type` properties |
#### Example
@@ -1403,14 +1423,14 @@ Creates a user account after an invited user provides registration information a
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| email | string | body | **Required**. The email address of the user. |
+| Name | Type | In | Description |
+| --------------------- | ------ | ---- | ----------------------------------------------------------------- |
+| email | string | body | **Required**. The email address of the user. |
| invite_token | string | body | **Required**. Token provided to the user in the invitation email. |
-| name | string | body | The name of the user. |
-| username | string | body | **Required**. The username chosen by the user |
-| password | string | body | **Required**. The password chosen by the user. |
-| password_confirmation | string | body | **Required**. Confirmation of the password chosen by the user. |
+| name | string | body | The name of the user. |
+| username | string | body | **Required**. The username chosen by the user |
+| password | string | body | **Required**. The password chosen by the user. |
+| password_confirmation | string | body | **Required**. Confirmation of the password chosen by the user. |
#### Example
@@ -1509,11 +1529,12 @@ Creates a user account without requiring an invitation, the user is enabled imme
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| username | string | body | **Required**. The user's username. |
-| email | string | body | **Required**. The user's email address. |
-| password | string | body | **Required**. The user's password. |
+| Name | Type | In | Description |
+| ---------- | ------- | ---- | ---------------------------------------------------- |
+| username | string | body | **Required**. The user's username. |
+| email | string | body | **Required**. The user's email address. |
+| password | string | body | **Required**. The user's password. |
+| invited_by | integer | body | **Required**. ID of the admin creating the user. |
| admin | boolean | body | **Required**. Whether the user has admin privileges. |
#### Example
@@ -1593,8 +1614,8 @@ Returns all information about a specific user.
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
| id | integer | path | **Required**. The user's id. |
#### Example
@@ -1669,14 +1690,14 @@ Returns all information about a specific user.
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| id | integer | path | **Required**. The user's id. |
-| name | string | body | The user's name. |
-| username | string | body | The user's username. |
-| position | string | body | The user's position. |
-| email | string | body | The user's email. |
-| sso_enabled | boolean | body | Whether or not SSO is enabled for the user. |
+| Name | Type | In | Description |
+| ----------- | ------- | ---- | ------------------------------------------- |
+| id | integer | path | **Required**. The user's id. |
+| name | string | body | The user's name. |
+| username | string | body | The user's username. |
+| position | string | body | The user's position. |
+| email | string | body | The user's email. |
+| sso_enabled | boolean | body | Whether or not SSO is enabled for the user. |
#### Example
@@ -1747,9 +1768,9 @@ Promotes or demotes the selected user's level of access as an admin in Fleet. Ad
#### Parameters
-| Name | Type | In | Description |
-| ----- | ------- | ----- | ---------------------------- |
-| id | integer | path | **Required**. The user's id. |
+| Name | Type | In | Description |
+| ----- | ------- | ---- | -------------------------------------------------- |
+| id | integer | path | **Required**. The user's id. |
| admin | boolean | body | **Required**. Whether or not the user is an admin. |
#### Example
@@ -1794,10 +1815,10 @@ The selected user is logged out of Fleet and required to reset their password du
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| id | integer | path | **Required**. The user's id. |
-| reset | boolean | body | Whether or not the user is required to reset their password during the next attempt to log in. |
+| Name | Type | In | Description |
+| ----- | ------- | ---- | ---------------------------------------------------------------------------------------------- |
+| id | integer | path | **Required**. The user's id. |
+| reset | boolean | body | Whether or not the user is required to reset their password during the next attempt to log in. |
#### Example
@@ -1881,9 +1902,9 @@ Deletes the selected user's sessions in Fleet. Also deletes the user's API token
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required**. The ID of the desired user. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ----------------------------------------- |
+| id | integer | path | **Required**. The ID of the desired user. |
#### Example
@@ -1900,6 +1921,7 @@ Deletes the selected user's sessions in Fleet. Also deletes the user's API token
---
## Sessions
+
- [Get session info](#get-session-info)
- [Delete session](#delete-session)
@@ -1911,9 +1933,9 @@ Returns the session information for the session specified by ID.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required**. The ID of the desired session. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | -------------------------------------------- |
+| id | integer | path | **Required**. The ID of the desired session. |
#### Example
@@ -1939,15 +1961,14 @@ Deletes the session specified by ID. When the user associated with the session n
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required**. The id of the desired session. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | -------------------------------------------- |
+| id | integer | path | **Required**. The id of the desired session. |
#### Example
`DELETE /api/v1/fleet/sessions/1`
-
##### Default response
`Status: 200`
@@ -1985,15 +2006,14 @@ Returns the query specified by ID.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required**. The id of the desired query. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ------------------------------------------ |
+| id | integer | path | **Required**. The id of the desired query. |
#### Example
`GET /api/v1/fleet/queries/31`
-
##### Default response
`Status: 200`
@@ -2033,16 +2053,15 @@ Returns a list of all queries in the Fleet instance.
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| order_key | string | query | What to order results by. Can be any column in the queries table. |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| Name | Type | In | Description |
+| --------------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------- |
+| order_key | string | query | What to order results by. Can be any column in the queries table. |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
#### Example
`GET /api/v1/fleet/queries`
-
##### Default response
`Status: 200`
@@ -2134,11 +2153,11 @@ Returns a list of all queries in the Fleet instance.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| name | string | body | **Required**. The name of the query. |
-| query | string | body | **Required**. The query in SQL syntax. |
-| description | string | body | The query's description. |
+| Name | Type | In | Description |
+| ----------- | ------ | ---- | -------------------------------------- |
+| name | string | body | **Required**. The name of the query. |
+| query | string | body | **Required**. The query in SQL syntax. |
+| description | string | body | The query's description. |
#### Example
@@ -2183,12 +2202,12 @@ Returns the query specified by ID.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required.** The ID of the query. |
-| name | string | body | The name of the query. |
-| query | string | body | The query in SQL syntax. |
-| description | string | body | The query's description. |
+| Name | Type | In | Description |
+| ----------- | ------- | ---- | ---------------------------------- |
+| id | integer | path | **Required.** The ID of the query. |
+| name | string | body | The name of the query. |
+| query | string | body | The query in SQL syntax. |
+| description | string | body | The query's description. |
#### Example
@@ -2231,9 +2250,9 @@ Deletes the query specified by name.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| name | string | path | **Required.** The name of the query. |
+| Name | Type | In | Description |
+| ---- | ------ | ---- | ------------------------------------ |
+| name | string | path | **Required.** The name of the query. |
#### Example
@@ -2255,9 +2274,9 @@ Deletes the query specified by ID.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required.** The ID of the query. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------------- |
+| id | integer | path | **Required.** The ID of the query. |
#### Example
@@ -2279,9 +2298,9 @@ Deletes the queries specified by ID. Returns the count of queries successfully d
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| ids | list | body | **Required.** The IDs of the queries. |
+| Name | Type | In | Description |
+| ---- | ---- | ---- | ------------------------------------- |
+| ids | list | body | **Required.** The IDs of the queries. |
#### Example
@@ -2355,9 +2374,9 @@ Returns the name, description, and SQL of the query specified by name.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| name | string | path | **Required.** The name of the query. |
+| Name | Type | In | Description |
+| ---- | ------ | ---- | ------------------------------------ |
+| name | string | path | **Required.** The name of the query. |
#### Example
@@ -2385,9 +2404,9 @@ Creates and/or modifies the queries included in the specs list. To modify an exi
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| specs | list | body | **Required.** The list of the queries to be created or modified. |
+| Name | Type | In | Description |
+| ----- | ---- | ---- | ---------------------------------------------------------------- |
+| specs | list | body | **Required.** The list of the queries to be created or modified. |
#### Example
@@ -2477,10 +2496,10 @@ Runs the specified query as a live query on the specified hosts or group of host
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| query | string | body | **Required.** The SQL of the query. |
-| selected | object | body | **Required.** The desired targets for the query specified by ID. This object can contain `hosts` and/or `labels` properties. See examples below. |
+| Name | Type | In | Description |
+| -------- | ------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| query | string | body | **Required.** The SQL of the query. |
+| selected | object | body | **Required.** The desired targets for the query specified by ID. This object can contain `hosts` and/or `labels` properties. See examples below. |
#### Example with one host targeted by ID
@@ -2491,7 +2510,7 @@ Runs the specified query as a live query on the specified hosts or group of host
```
{
"query": "select instance_id from system_info",
- "selected": {
+ "selected": {
"hosts": [171]
}
}
@@ -2530,7 +2549,7 @@ Runs the specified query as a live query on the specified hosts or group of host
```
{
"query": "select instance_id from system_info;",
- "selected": {
+ "selected": {
"labels": [7]
}
}
@@ -2568,10 +2587,10 @@ Runs the specified query as a live query on the specified hosts or group of host
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| query | string | body | **Required.** The SQL of the query. |
-| selected | object | body | **Required.** The desired targets for the query specified by name. This object can contain `hosts` and/or `labels` properties. See examples below. |
+| Name | Type | In | Description |
+| -------- | ------ | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| query | string | body | **Required.** The SQL of the query. |
+| selected | object | body | **Required.** The desired targets for the query specified by name. This object can contain `hosts` and/or `labels` properties. See examples below. |
#### Example with one host targeted by hostname
@@ -2582,9 +2601,9 @@ Runs the specified query as a live query on the specified hosts or group of host
```
{
"query": "select instance_id from system_info",
- "selected": {
+ "selected": {
"hosts": [
- "macbook-pro.local",
+ "macbook-pro.local",
]
}
}
@@ -2623,7 +2642,7 @@ Runs the specified query as a live query on the specified hosts or group of host
```
{
"query": "select instance_id from system_info",
- "selected": {
+ "selected": {
"labels": [
"All Hosts"
]
@@ -2657,7 +2676,7 @@ Runs the specified query as a live query on the specified hosts or group of host
### Retrieve live query results (standard WebSocket API)
-You can retrieve the results of a live query using the [standard WebSocket API](#https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_client_applications).
+You can retrieve the results of a live query using the [standard WebSocket API](#https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_client_applications).
Before you retrieve the live query results, you must create a live query campaign by running the live query. See the documentation for the [Run live query](#run-live-query) endpoint to create a live query campaign.
@@ -2665,10 +2684,10 @@ Before you retrieve the live query results, you must create a live query campaig
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| token | string | | **Required.** The token used to authenticate with the Fleet API. |
-| campaignID | integer | | **Required.** The ID of the live query campaign. |
+| Name | Type | In | Description |
+| ---------- | ------- | --- | ---------------------------------------------------------------- |
+| token | string | | **Required.** The token used to authenticate with the Fleet API. |
+| campaignID | integer | | **Required.** The ID of the live query campaign. |
#### Example
@@ -2707,9 +2726,9 @@ o
```
[
- {
- "type": "auth",
- "data": { "token": }
+ {
+ "type": "auth",
+ "data": { "token": }
}
]
```
@@ -2717,7 +2736,7 @@ o
```
[
{
- "type": "select_campaign",
+ "type": "select_campaign",
"data": { "campaign_id": 12 }
}
]
@@ -2804,10 +2823,10 @@ You can also retrieve live query results with a [SockJS client](https://github.c
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| token | string | | **Required.** The token used to authenticate with the Fleet API. |
-| campaignID | integer | | **Required.** The ID of the live query campaign. |
+| Name | Type | In | Description |
+| ---------- | ------- | --- | ---------------------------------------------------------------- |
+| token | string | | **Required.** The token used to authenticate with the Fleet API. |
+| campaignID | integer | | **Required.** The ID of the live query campaign. |
#### Example
@@ -2824,7 +2843,7 @@ socket.onopen = () => {
socket.onmessage = ({ data }) => {
console.log(data);
const message = JSON.parse(data);
-
+
if (message.type === 'status' && message.data.status === 'finished') {
socket.close();
}
@@ -2847,9 +2866,9 @@ o
```
[
- {
- "type": "auth",
- "data": { "token": }
+ {
+ "type": "auth",
+ "data": { "token": }
}
]
```
@@ -2857,7 +2876,7 @@ o
```
[
{
- "type": "select_campaign",
+ "type": "select_campaign",
"data": { "campaign_id": 12 }
}
]
@@ -2961,12 +2980,12 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| name | string | body | **Required**. The pack's name. |
-| description | string | body | The pack's description. |
-| host_ids | list | body | A list containing the targeted host IDs. |
-| label_ids | list | body | A list containing the targeted label's IDs. |
+| Name | Type | In | Description |
+| ----------- | ------ | ---- | ------------------------------------------- |
+| name | string | body | **Required**. The pack's name. |
+| description | string | body | The pack's description. |
+| host_ids | list | body | A list containing the targeted host IDs. |
+| label_ids | list | body | A list containing the targeted label's IDs. |
#### Example
@@ -3011,13 +3030,13 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| id | integer | path | **Required.** The pack's id. |
-| name | string | body | The pack's name. |
-| description | string | body | The pack's description. |
-| host_ids | list | body | A list containing the targeted host IDs. |
-| label_ids | list | body | A list containing the targeted label's IDs. |
+| Name | Type | In | Description |
+| ----------- | ------- | ---- | ------------------------------------------- |
+| id | integer | path | **Required.** The pack's id. |
+| name | string | body | The pack's name. |
+| description | string | body | The pack's description. |
+| host_ids | list | body | A list containing the targeted host IDs. |
+| label_ids | list | body | A list containing the targeted label's IDs. |
#### Example
@@ -3061,8 +3080,8 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
| id | integer | path | **Required.** The pack's id. |
#### Example
@@ -3097,10 +3116,10 @@ o
#### Parameters
-| Name | Type | In | Description |
-| --------------------- | ------ | ---- | --------------------------------------------------------------- |
-| order_key | string | query | What to order results by. Can be any column in the packs table. |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+| Name | Type | In | Description |
+| --------------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------- |
+| order_key | string | query | What to order results by. Can be any column in the packs table. |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
#### Example
@@ -3149,9 +3168,9 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| name | string | path | **Required.** The pack's name. |
+| Name | Type | In | Description |
+| ---- | ------ | ---- | ------------------------------ |
+| name | string | path | **Required.** The pack's name. |
#### Example
@@ -3171,8 +3190,8 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
| id | integer | path | **Required.** The pack's ID. |
#### Example
@@ -3193,8 +3212,8 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
| id | integer | path | **Required.** The pack's ID. |
#### Example
@@ -3260,22 +3279,22 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| pack_id | integer | body | **Required.** The pack's ID. |
-| query_id | integer | body | **Required.** The query's ID. |
-| interval | integer | body | **Required.** The amount of time, in seconds, the query waits before running. |
-| snapshot | boolean | body | **Required.** Whether the queries logs show everything in its current state. |
-| removed | boolean | body | **Required.** Whether "removed" actions should be logged. |
-| platform | string | body | The computer platform where this query will run (other platforms ignored). Empty value runs on all platforms. |
-| shard | integer | body | Restrict this query to a percentage (1-100) of target hosts. |
-| version | string | body | The minimum required osqueryd version installed on a host. |
+| Name | Type | In | Description |
+| -------- | ------- | ---- | ------------------------------------------------------------------------------------------------------------- |
+| pack_id | integer | body | **Required.** The pack's ID. |
+| query_id | integer | body | **Required.** The query's ID. |
+| interval | integer | body | **Required.** The amount of time, in seconds, the query waits before running. |
+| snapshot | boolean | body | **Required.** Whether the queries logs show everything in its current state. |
+| removed | boolean | body | **Required.** Whether "removed" actions should be logged. |
+| platform | string | body | The computer platform where this query will run (other platforms ignored). Empty value runs on all platforms. |
+| shard | integer | body | Restrict this query to a percentage (1-100) of target hosts. |
+| version | string | body | The minimum required osqueryd version installed on a host. |
#### Example
`POST /api/v1/fleet/schedule`
-#### Request body
+#### Request body
```
{
@@ -3321,8 +3340,8 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | --------------------------------------- |
| id | integer | path | **Required.** The scheduled query's ID. |
#### Example
@@ -3360,21 +3379,21 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| id | integer | path | **Required.** The scheduled query's ID. |
-| interval | integer | body | The amount of time, in seconds, the query waits before running. |
-| snapshot | boolean | body | Whether the queries logs show everything in its current state. |
-| removed | boolean | body | Whether "removed" actions should be logged. |
-| platform | string | body | The computer platform where this query will run (other platforms ignored). Empty value runs on all platforms. |
-| shard | integer | body | Restrict this query to a percentage (1-100) of target hosts. |
-| version | string | body | The minimum required osqueryd version installed on a host. |
+| Name | Type | In | Description |
+| -------- | ------- | ---- | ------------------------------------------------------------------------------------------------------------- |
+| id | integer | path | **Required.** The scheduled query's ID. |
+| interval | integer | body | The amount of time, in seconds, the query waits before running. |
+| snapshot | boolean | body | Whether the queries logs show everything in its current state. |
+| removed | boolean | body | Whether "removed" actions should be logged. |
+| platform | string | body | The computer platform where this query will run (other platforms ignored). Empty value runs on all platforms. |
+| shard | integer | body | Restrict this query to a percentage (1-100) of target hosts. |
+| version | string | body | The minimum required osqueryd version installed on a host. |
#### Example
`PATCH /api/v1/fleet/schedule/56`
-#### Request body
+#### Request body
```
{
@@ -3413,8 +3432,8 @@ o
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | --------------------------------------- |
| id | integer | path | **Required.** The scheduled query's ID. |
#### Example
@@ -3538,9 +3557,9 @@ Returns the specs for all packs in the Fleet instance.
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| specs | list | body | **Required.** A list that includes the specs for each pack to be added to the Fleet instance. |
+| Name | Type | In | Description |
+| ----- | ---- | ---- | --------------------------------------------------------------------------------------------- |
+| specs | list | body | **Required.** A list that includes the specs for each pack to be added to the Fleet instance. |
#### Example
@@ -3651,9 +3670,9 @@ Returns the spec for the specified pack by pack name.
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| name | string | path | **Required.** The pack's name. |
+| Name | Type | In | Description |
+| ---- | ------ | ---- | ------------------------------ |
+| name | string | path | **Required.** The pack's name. |
#### Example
@@ -3735,10 +3754,10 @@ The search targets endpoint returns two lists. The first list includes the possi
#### Parameters
-| Name | Type | In | Description |
-| ---- | ------- | ----- | ---------------------------- |
-| query | string | body | The search query. Searchable items include a host's hostname or IPv4 address and labels. |
-| selected | object | body | The targets already selected. The object includes a `hosts` property which contains a list of host IDs and a `labels` property which contains a list of label IDs.|
+| Name | Type | In | Description |
+| -------- | ------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| query | string | body | The search query. Searchable items include a host's hostname or IPv4 address and labels. |
+| selected | object | body | The targets already selected. The object includes a `hosts` property which contains a list of host IDs and a `labels` property which contains a list of label IDs. |
#### Example
@@ -3750,7 +3769,7 @@ The search targets endpoint returns two lists. The first list includes the possi
{
"query": "172",
"selected": {
- "hosts": [],
+ "hosts": [],
"labels": [7]
}
}
@@ -3893,7 +3912,6 @@ None.
`GET /api/v1/fleet/config/certificate`
-
##### Default response
`Status: 200`
@@ -3918,7 +3936,6 @@ None.
`GET /api/v1/fleet/config`
-
##### Default response
`Status: 200`
@@ -3975,33 +3992,33 @@ Modifies the Fleet's configuration with the supplied information.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| org_name | string | body | *Organization information*. The organization name. |
-| org_logo_url | string | body | *Organization information*. The URL for the organization logo. |
-| kolide_server_url | string | body | *Server settings*. The Fleet server URL. |
-| live_query_disabled | boolean | body | *Server settings*. Whether the live query capabilities are disabled. |
-| enable_smtp | boolean | body | *SMTP settings*. Whether SMTP is enabled for the Fleet app. |
-| sender_address | string | body | *SMTP settings*. The sender email address for the Fleet app. An invitation email is an example of the emails that may use this sender address |
-| server | string | body | *SMTP settings*. The SMTP server for the Fleet app. |
-| port | integer | body | *SMTP settings*. The SMTP port for the Fleet app. |
-| authentication_type | string | body | *SMTP settings*. The authentication type used by the SMTP server. Options include `"authtype_username_and_password"` or `"none"`|
-| username_name | string | body | *SMTP settings*. The username used to authenticate requests made to the SMTP server.|
-| password | string | body | *SMTP settings*. The password used to authenticate requests made to the SMTP server.|
-| enable_ssl_tls | boolean | body | *SMTP settings*. Whether or not SSL and TLS are enabled for the SMTP server.|
-| authentication_method | string | body | *SMTP settings*. The authentication method used to make authenticate requests to SMTP server. Options include `"authmethod_plain"`, `"authmethod_cram_md5"`, and `"authmethod_login"`.|
-| domain | string | body | *SMTP settings*. The domain for the SMTP server.|
-| verify_ssl_certs | boolean | body | *SMTP settings*. Whether or not SSL certificates are verified by the SMTP server. Turn this off (not recommended) if you use a self-signed certificate. |
-| enabled_start_tls | boolean | body | *SMTP settings*. Detects if STARTTLS is enabled in your SMTP server and starts to use it.|
-| enabled_sso | boolean | body | *SSO settings*. Whether or not SSO is enabled for the Fleet application. If this value is true, you must also include most of the SSO settings parameters below.|
-| entity_id | string | body | *SSO settings*. The required entity ID is a URI that you use to identify Fleet when configuring the identity provider. |
-| issuer_uri | string | body | *SSO settings*. The URI you provide here must exactly match the Entity ID field used in the identity provider configuration. |
-| idp_image_url | string | body | *SSO settings*. An optional link to an image such as a logo for the identity provider. |
-| metadata | string | body | *SSO settings*. Metadata provided by the identity provider. Either metadata or a metadata URL must be provided. |
-| metadata_url | string | body | *SSO settings*. A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata. |
-| host_expiry_enabled | boolean | body | *Host expiry settings*. When enabled, allows automatic cleanup of hosts that have not communicated with Fleet in some number of days. |
-| host_expiry_window | integer | body | *Host expiry settings*. If a host has not communicated with Fleet in the specified number of days, it will be removed. |
-| additional_queries | boolean | body | Whether or not additional queries are enabled on hosts. |
+| Name | Type | In | Description |
+| --------------------- | ------- | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| org_name | string | body | _Organization information_. The organization name. |
+| org_logo_url | string | body | _Organization information_. The URL for the organization logo. |
+| kolide_server_url | string | body | _Server settings_. The Fleet server URL. |
+| live_query_disabled | boolean | body | _Server settings_. Whether the live query capabilities are disabled. |
+| enable_smtp | boolean | body | _SMTP settings_. Whether SMTP is enabled for the Fleet app. |
+| sender_address | string | body | _SMTP settings_. The sender email address for the Fleet app. An invitation email is an example of the emails that may use this sender address |
+| server | string | body | _SMTP settings_. The SMTP server for the Fleet app. |
+| port | integer | body | _SMTP settings_. The SMTP port for the Fleet app. |
+| authentication_type | string | body | _SMTP settings_. The authentication type used by the SMTP server. Options include `"authtype_username_and_password"` or `"none"` |
+| username_name | string | body | _SMTP settings_. The username used to authenticate requests made to the SMTP server. |
+| password | string | body | _SMTP settings_. The password used to authenticate requests made to the SMTP server. |
+| enable_ssl_tls | boolean | body | _SMTP settings_. Whether or not SSL and TLS are enabled for the SMTP server. |
+| authentication_method | string | body | _SMTP settings_. The authentication method used to make authenticate requests to SMTP server. Options include `"authmethod_plain"`, `"authmethod_cram_md5"`, and `"authmethod_login"`. |
+| domain | string | body | _SMTP settings_. The domain for the SMTP server. |
+| verify_ssl_certs | boolean | body | _SMTP settings_. Whether or not SSL certificates are verified by the SMTP server. Turn this off (not recommended) if you use a self-signed certificate. |
+| enabled_start_tls | boolean | body | _SMTP settings_. Detects if STARTTLS is enabled in your SMTP server and starts to use it. |
+| enabled_sso | boolean | body | _SSO settings_. Whether or not SSO is enabled for the Fleet application. If this value is true, you must also include most of the SSO settings parameters below. |
+| entity_id | string | body | _SSO settings_. The required entity ID is a URI that you use to identify Fleet when configuring the identity provider. |
+| issuer_uri | string | body | _SSO settings_. The URI you provide here must exactly match the Entity ID field used in the identity provider configuration. |
+| idp_image_url | string | body | _SSO settings_. An optional link to an image such as a logo for the identity provider. |
+| metadata | string | body | _SSO settings_. Metadata provided by the identity provider. Either metadata or a metadata URL must be provided. |
+| metadata_url | string | body | _SSO settings_. A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata. |
+| host_expiry_enabled | boolean | body | _Host expiry settings_. When enabled, allows automatic cleanup of hosts that have not communicated with Fleet in some number of days. |
+| host_expiry_window | integer | body | _Host expiry settings_. If a host has not communicated with Fleet in the specified number of days, it will be removed. |
+| additional_queries | boolean | body | Whether or not additional queries are enabled on hosts. |
#### Example
@@ -4023,7 +4040,6 @@ Modifies the Fleet's configuration with the supplied information.
}
```
-
##### Default response
`Status: 200`
@@ -4086,7 +4102,6 @@ None.
`GET /api/v1/fleet/spec/enroll_secret`
-
##### Default response
`Status: 200`
@@ -4126,11 +4141,11 @@ Modifies and/or creates the specified enroll secret(s).
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| name | string | body | **Required.** The name of the enroll secret |
-| secret | string | body | **Required.** The plain text string used as the enroll secret. |
-| active | boolean | body | Whether or not the enroll secret is active. Must be set to true for hosts to enroll using the enroll secret. |
+| Name | Type | In | Description |
+| ------ | ------- | ---- | ------------------------------------------------------------------------------------------------------------ |
+| name | string | body | **Required.** The name of the enroll secret |
+| secret | string | body | **Required.** The plain text string used as the enroll secret. |
+| active | boolean | body | Whether or not the enroll secret is active. Must be set to true for hosts to enroll using the enroll secret. |
#### Example
@@ -4152,7 +4167,6 @@ Modifies and/or creates the specified enroll secret(s).
`POST /api/v1/fleet/spec/enroll_secret`
-
##### Default response
`Status: 200`
@@ -4163,7 +4177,6 @@ Modifies and/or creates the specified enroll secret(s).
### Create invite
-
`POST /api/v1/fleet/invites`
#### Parameters
@@ -4190,7 +4203,6 @@ Modifies and/or creates the specified enroll secret(s).
`POST /api/v1/fleet/invites`
-
##### Default response
`Status: 200`
@@ -4228,7 +4240,6 @@ Returns a list of the active invitations in Fleet.
`GET /api/v1/fleet/invites`
-
##### Default response
`Status: 200`
@@ -4268,15 +4279,14 @@ Delete the specified invite from Fleet.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required.** The user's id. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ---------------------------- |
+| id | integer | path | **Required.** The user's id. |
#### Example
`DELETE /api/v1/fleet/invites/{id}`
-
##### Default response
`Status: 200`
@@ -4293,15 +4303,14 @@ Verify the specified invite.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| token | integer | path | **Required.** Token provided to the user in the invitation email.|
+| Name | Type | In | Description |
+| ----- | ------- | ---- | ----------------------------------------------------------------- |
+| token | integer | path | **Required.** Token provided to the user in the invitation email. |
#### Example
`GET /api/v1/fleet/invites/{token}`
-
##### Default response
`Status: 200`
@@ -4345,15 +4354,14 @@ Changes the email specified by token.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| token | integer | path | **Required.** The token provided to the user in the email change confirmation email.|
+| Name | Type | In | Description |
+| ----- | ------- | ---- | ------------------------------------------------------------------------------------ |
+| token | integer | path | **Required.** The token provided to the user in the email change confirmation email. |
#### Example
`GET /api/v1/fleet/invites/{token}`
-
##### Default response
`Status: 200`
@@ -4363,6 +4371,7 @@ Changes the email specified by token.
"new_email": janedoe@example.com
}
```
+
---
### Version
@@ -4393,6 +4402,7 @@ None.
"build_user": "zwass"
}
```
+
---
## Osquery options
@@ -4414,7 +4424,6 @@ None.
`GET /api/v1/fleet/spec/osquery_options`
-
##### Default response
`Status: 200`
@@ -4453,9 +4462,9 @@ Modifies the osquery options configuration set in Fleet.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| spec | JSON | body | **Required.** The modified osquery spec. |
+| Name | Type | In | Description |
+| ---- | ---- | ---- | ---------------------------------------- |
+| spec | JSON | body | **Required.** The modified osquery spec. |
#### Example
@@ -4489,7 +4498,6 @@ Modifies the osquery options configuration set in Fleet.
}
```
-
##### Default response
`Status: 200`
@@ -4508,7 +4516,7 @@ Modifies the osquery options configuration set in Fleet.
Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from osquery agents, returning the full contents to Fleet.
-To initiate a file carve using the Fleet API, you can use the [live query](#run-live-query) or [scheduled query](#add-scheduled-query-to-a-pack) endpoints to run a query against the `carves` table.
+To initiate a file carve using the Fleet API, you can use the [live query](#run-live-query) or [scheduled query](#add-scheduled-query-to-a-pack) endpoints to run a query against the `carves` table.
For more information on executing a file carve in Fleet, go to the [File carving with Fleet docs](../1-Using-Fleet/2-fleetctl-CLI.md#file-carving-with-fleet).
@@ -4573,9 +4581,9 @@ Retrieves the specified carve.
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required.** The desired carve's ID. |
+| Name | Type | In | Description |
+| ---- | ------- | ---- | ------------------------------------- |
+| id | integer | path | **Required.** The desired carve's ID. |
#### Example
@@ -4612,10 +4620,10 @@ Retrieves the specified carve block. This endpoint retrieves the data that was c
#### Parameters
-| Name | Type | In | Description |
-| ---------- | ------- | ---- | ------------------------------------------------ |
-| id | integer | path | **Required.** The desired carve's ID. |
-| block_id | integer | path | **Required.** The desired carve block's ID. |
+| Name | Type | In | Description |
+| -------- | ------- | ---- | ------------------------------------------- |
+| id | integer | path | **Required.** The desired carve's ID. |
+| block_id | integer | path | **Required.** The desired carve block's ID. |
#### Example
diff --git a/docs/1-Using-Fleet/4-Osquery-logs.md b/docs/1-Using-Fleet/4-Osquery-logs.md
index d51b300fef..2550b1a4ee 100644
--- a/docs/1-Using-Fleet/4-Osquery-logs.md
+++ b/docs/1-Using-Fleet/4-Osquery-logs.md
@@ -22,21 +22,21 @@ Fleet supports the following logging plugins for osquery logs:
- [PubSub](#pubsub) - Logs are written to Google Cloud PubSub topics.
- [Stdout](#stdout) - Logs are written to stdout.
-To set the osquery logging plugins, use the `--osquery_result_log_plugin` and `--osquery_status_log_plugin` flags (or [equivalents for environment variables or configuration files](../2-Deployment/2-Configuration.md#options)).
+To set the osquery logging plugins, use the `--osquery_result_log_plugin` and `--osquery_status_log_plugin` flags (or [equivalents for environment variables or configuration files](../3-Deployment/2-Configuration.md#options)).
### Filesystem
The default logging plugin.
- Plugin name: `filesystem`
-- Flag namespace: [filesystem](../2-Deployment/2-Configuration.md#filesystem)
+- Flag namespace: [filesystem](../3-Deployment/2-Configuration.md#filesystem)
With the filesystem plugin, osquery result and/or status logs are written to the local filesystem on the Fleet server. This is typically used with a log forwarding agent on the Fleet server that will push the logs into a logging pipeline. Note that if multiple load-balanced Fleet servers are used, the logs will be load-balanced across those servers (not duplicated).
### Firehose
- Plugin name: `firehose`
-- Flag namespace: [firehose](../2-Deployment/2-Configuration.md#firehose)
+- Flag namespace: [firehose](../3-Deployment/2-Configuration.md#firehose)
With the Firehose plugin, osquery result and/or status logs are written to [AWS Firehose](https://aws.amazon.com/kinesis/data-firehose/) streams. This is a very good method for aggregating osquery logs into AWS S3 storage.
@@ -45,7 +45,7 @@ Note that Firehose logging has limits [discussed in the documentation](https://d
### Kinesis
- Plugin name: `kinesis`
-- Flag namespace: [kinesis](../2-Deployment/2-Configuration.md#kinesis)
+- Flag namespace: [kinesis](../3-Deployment/2-Configuration.md#kinesis)
With the Kinesis plugin, osquery result and/or status logs are written to
[AWS Kinesis](https://aws.amazon.com/kinesis/data-streams) streams.
@@ -58,7 +58,7 @@ output in the Fleet logs and those logs _will not_ be sent to Kinesis.
### Lambda
- Plugin name: `lambda`
-- Flag namespace: [lambda](../2-Deployment/2-Configuration.md#lambda)
+- Flag namespace: [lambda](../3-Deployment/2-Configuration.md#lambda)
With the Lambda plugin, osquery result and/or status logs are written to
[AWS Lambda](https://aws.amazon.com/lambda/) functions.
@@ -73,7 +73,7 @@ output in the Fleet logs and those logs _will not_ be sent to Lambda.
### PubSub
- Plugin name: `pubsub`
-- Flag namespace: [pubsub](../2-Deployment/2-Configuration.md#pubsub)
+- Flag namespace: [pubsub](../3-Deployment/2-Configuration.md#pubsub)
With the PubSub plugin, osquery result and/or status logs are written to [PubSub](https://cloud.google.com/pubsub/) topics.
@@ -82,7 +82,7 @@ Note that messages over 10MB will be dropped, with a notification sent to the fl
### Stdout
- Plugin name: `stdout`
-- Flag namespace: [stdout](../2-Deployment/2-Configuration.md#stdout)
+- Flag namespace: [stdout](../3-Deployment/2-Configuration.md#stdout)
With the stdout plugin, osquery result and/or status logs are written to stdout
on the Fleet server. This is typically used for debugging or with a log
diff --git a/docs/1-Using-Fleet/6-Security-best-practices.md b/docs/1-Using-Fleet/6-Security-best-practices.md
index f3a54d0345..f3ff1acf19 100644
--- a/docs/1-Using-Fleet/6-Security-best-practices.md
+++ b/docs/1-Using-Fleet/6-Security-best-practices.md
@@ -27,7 +27,7 @@ Fleet supports SAML auth which means that it can be configured such that it neve
Passwords are never stored in plaintext in the database. We store a `bcrypt`ed hash of the password along with a randomly generated salt. The `bcrypt` iteration count and salt key size are admin-configurable.
### Authentication tokens
-The size and expiration time of session tokens is admin-configurable. See [https://github.com/fleetdm/fleet/blob/master/docs/2-Deployment/2-Configuration.md#session_duration](../2-Deployment/2-Configuration.md#session_duration).
+The size and expiration time of session tokens is admin-configurable. See [https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/2-Configuration.md#session_duration](../3-Deployment/2-Configuration.md#session_duration).
It is possible to revoke all session tokens for a user by forcing a password reset.
diff --git a/docs/1-Using-Fleet/7-Updating-Fleet.md b/docs/1-Using-Fleet/7-Updating-Fleet.md
index 842693b552..1bdee324e5 100644
--- a/docs/1-Using-Fleet/7-Updating-Fleet.md
+++ b/docs/1-Using-Fleet/7-Updating-Fleet.md
@@ -7,7 +7,7 @@
## Overview
-This guide explains how to update and run new versions of Fleet. For initial installation instructions, see [Installing Fleet](../2-Deployment/1-Installation.md).
+This guide explains how to update and run new versions of Fleet. For initial installation instructions, see [Installing Fleet](../3-Deployment/1-Installation.md).
There are two steps to perform a typical Fleet update. If any other steps are required, they will be noted in the release notes.
diff --git a/docs/1-Using-Fleet/FAQ.md b/docs/1-Using-Fleet/FAQ.md
index 5054bd9392..7aeb59eaae 100644
--- a/docs/1-Using-Fleet/FAQ.md
+++ b/docs/1-Using-Fleet/FAQ.md
@@ -1,22 +1,35 @@
# Using Fleet FAQ
+
- [Has anyone stress tested Fleet? How many clients can the Fleet server handle?](#has-anyone-stress-tested-fleet-how-many-clients-can-the-fleet-server-handle)
+- [Can I target my hosts using their enroll secrets?](#can-I-target-my-hosts-using-their-enroll-secrets)
- [How often do labels refresh? Is the refresh frequency configurable?](#how-often-do-labels-refresh-is-the-refresh-frequency-configurable)
- [How do I revoke the authorization tokens for a user?](#how-do-i-revoke-the-authorization-tokens-for-a-user)
- [How do I monitor the performance of my queries?](#how-do-i-monitor-the-performance-of-my-queries)
- [How do I monitor a Fleet server?](#how-do-i-monitor-a-fleet-server)
- [Why is the “Add User” button disabled?](#why-is-the-add-user-button-disabled)
+- [Can I disable password-based authentication in the Fleet UI?](#can-i-disable-password-based-authentication-in-the-fleet-ui)
- [Where are my query results?](#where-are-my-query-results)
- [Why aren’t my live queries being logged?](#why-arent-my-live-queries-being-logged)
+- [Can I use the Fleet API to fetch results from a scheduled query pack?](#can-i-use-the-fleet-api-to-fetch-results-from-a-scheduled-query-pack)
+- [How do I automatically add hosts to packs when the hosts enroll to Fleet?](#how-do-i-automatically-add-hosts-to-packs-when-the-hosts-enroll-to-Fleet)
## Has anyone stress tested Fleet? How many clients can the Fleet server handle?
-Fleet has been stress tested to 150,000 online hosts and 400,000 total enrolled hosts. There are numerous production deployments in the thousands, in the tens of thousands of hosts range, and there are production deployments in the high tens of thousands of hosts range.
+Fleet has been stress tested to 150,000 online hosts and 400,000 total enrolled hosts. Production deployments exist with over 100,000 hosts and numerous production deployments manage tens of thousands of hosts.
-It’s standard deployment practice to have multiple Fleet servers behind a load balancer. However, typically the MySQL database is the bottleneck and an individual Fleet server can handle tens of thousands of hosts.
+It’s standard deployment practice to have multiple Fleet servers behind a load balancer. However, typically the MySQL database is the performance bottleneck and a single Fleet server can handle tens of thousands of hosts.
+
+## Can I target my hosts using their enroll secrets?
+
+No, currently, there’s no way to retrieve the name of the enroll secret with a query. This means that there's no way to create a label using your hosts' enroll secrets and then use this label as a target for queries or query packs.
+
+Typically folks will use some other unique identifier to create labels that distinguish each type of device. As a workaround, [Fleet's manual labels](./2-fleetctl-CLI.md#host-labels) provide a way to create groups of hosts without a query. These manual labels can then be used as targets for queries or query packs.
+
+In the coming months, Fleet will introduce the [Teams feature](https://github.com/fleetdm/fleet/issues/288) to Fleet Basic customers. Teams will allow users to group hosts into teams using their enroll secret. These teams can then be targeted with specific queries, query packs, and configuration.
## How often do labels refresh? Is the refresh frequency configurable?
-The update frequency for labels is configurable with the [—osquery_label_update_interval](../2-Deployment/2-Configuration.md#osquery_label_update_interval) flag (default 1 hour).
+The update frequency for labels is configurable with the [—osquery_label_update_interval](https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/2-Configuration.md#osquery_label_update_interval) flag (default 1 hour).
## How do I revoke the authorization tokens for a user?
@@ -30,13 +43,21 @@ Fleet can live query the `osquery_schedule` table. Performing this live query al
Fleet provides standard interfaces for monitoring and alerting. See the [Monitoring Fleet](./5-Monitoring-Fleet.md) documentation for details.
-
## Why is the “Add User” button disabled?
The “Add User” button is disabled if SMTP (email) has not been configured for the Fleet server. Currently, there is no way to add new users without email capabilities.
One way to hack around this is to use a simulated mailserver like [Mailhog](https://github.com/mailhog/MailHog). You can retrieve the email that was “sent” in the Mailhog UI, and provide users with the invite URL manually.
+## Can I disable password-based authentication in the Fleet UI?
+
+Some folks like to enforce users with SAML SSO enabled to login only via the SSO and not via password.
+
+There is no option in the Fleet UI for disabling password-based authentication.
+However, users that have SSO enabled in Fleet will not be able to log in via password-based authentication.
+
+If a user has SSO enabled, the Login page in the Fleet UI does displays the “Username” and “Password” fields but on attempted password-based login, this user will receive an “Authentication failed” message.
+
## Where are my query results?
### Live Queries
@@ -45,15 +66,15 @@ Live query results (executed in the web UI or `fleetctl query`) are pushed direc
### Scheduled Queries
-Scheduled query results (queries that are scheduled to run in Packs) are typically sent to the Fleet server, and will be available on the filesystem of the server at the path configurable by [`--osquery_result_log_file`](../2-Deployment/2-Configuration.md#osquery_result_log_file). This defaults to `/tmp/osquery_result`.
+Scheduled query results (queries that are scheduled to run in Packs) are typically sent to the Fleet server, and will be available on the filesystem of the server at the path configurable by [`--osquery_result_log_file`](../3-Deployment/2-Configuration.md#osquery_result_log_file). This defaults to `/tmp/osquery_result`.
It is possible to configure osqueryd to log query results outside of Fleet. For results to go to Fleet, the `--logger_plugin` flag must be set to `tls`.
### What are my options for storing the osquery logs?
-Folks typically use Fleet to ship logs to data aggregation systems like Splunk, the ELK stack, and Graylog.
+Folks typically use Fleet to ship logs to data aggregation systems like Splunk, the ELK stack, and Graylog.
-The [logger configuration options](../2-Deployment/2-Configuration.md#osquery_status_log_plugin) allow you to select the log output plugin. Using the log outputs you can route the logs to your chosen aggregation system.
+The [logger configuration options](https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/2-Configuration.md#osquery_status_log_plugin) allow you to select the log output plugin. Using the log outputs you can route the logs to your chosen aggregation system.
### Troubleshooting
@@ -63,8 +84,30 @@ Expecting results, but not seeing anything in the logs?
- Check whether the query is scheduled in differential mode. If so, new results will only be logged when the result set changes.
- Ensure that the query is scheduled to run on the intended platforms, and that the tables queried are supported by those platforms.
- Use live query to `SELECT * FROM osquery_schedule` to check whether the query has been scheduled on the host.
-- Look at the status logs provided by osquery. In a standard configuration these are available on the filesystem of the Fleet server at the path configurable by [`--filesystem_status_log_file`](../2-Deployment/2-Configuration.md#filesystem_status_log_file). This defaults to `/tmp/osquery_status`. The host will output a status log each time it executes the query.
+- Look at the status logs provided by osquery. In a standard configuration these are available on the filesystem of the Fleet server at the path configurable by [`--filesystem_status_log_file`](../3-Deployment/2-Configuration.md#filesystem_status_log_file). This defaults to `/tmp/osquery_status`. The host will output a status log each time it executes the query.
## Why aren’t my live queries being logged?
-Live query results are never logged to the filesystem of the Fleet server. See [Where are my query results?](#where-are-my-query-results).
\ No newline at end of file
+Live query results are never logged to the filesystem of the Fleet server. See [Where are my query results?](#where-are-my-query-results).
+
+## Can I use the Fleet API to fetch results from a scheduled query pack?
+
+You cannot. Scheduled query results are logged to whatever logging plugin you have configured and are not stored in the Fleet DB.
+
+However, the Fleet API exposes a significant amount of host information via the [`api/v1/fleet/hosts`](./3-REST-API.md#list-hosts) and the [`api/v1/fleet/hosts/{id}`](./3-REST-API.md#get-host) API endpoints. The `api/v1/fleet/hosts` [can even be configured to return additional host information](https://github.com/fleetdm/fleet/blob/9fb9da31f5462fa7dda4819a114bbdbc0252c347/docs/1-Using-Fleet/2-fleetctl-CLI.md#fleet-configuration-options).
+
+As an example, let's say you want to retrieve a host's OS version, installed software, and kernel version:
+
+Each host’s OS version is available using the `api/v1/fleet/hosts` API endpoint. [Check out the API documentation for this endpoint](./3-REST-API.md#list-hosts).
+
+The ability to view each host’s installed software was released behind a feature flag in Fleet 3.11.0 and called Software inventory. [Check out the feature flag documentation for instructions on turning on Software inventory in Fleet](../3-Deployment/2-Configuration.md#feature-flags).
+
+Once the Software inventory feature is turned on, a list of a specific host’s installed software is available using the `api/v1/fleet/hosts/{id}` endpoint. [Check out the documentation for this endpoint](./3-REST-API.md#get-host).
+
+It’s possible in Fleet to retrieve each host’s kernel version, using the Fleet API, through `additional_queries`. The Fleet configuration options yaml file includes an `additional_queries` property that allows you to append custom query results to the host details returned by the `api/v1/fleet/hosts` endpoint. [Check out an example configuration file with the additional_queries field](./2-fleetctl-CLI.md#fleet-configuration-options).
+
+## How do I automatically add hosts to packs when the hosts enroll to Fleet?
+
+You can do this by setting the `targets` field in the [YAML configuration file](./2-fleetctl-CLI.md#query-packs) that manages the packs that are added to your Fleet instance.
+
+The `targets` field allows you to specify the `labels` field. With the `labels` field, the hosts that become members of the specified labels, upon enrolling to Fleet, will automatically become targets of the given pack.
diff --git a/docs/1-Using-Fleet/configuration-files/README.md b/docs/1-Using-Fleet/configuration-files/README.md
new file mode 100644
index 0000000000..83d8ca7de0
--- /dev/null
+++ b/docs/1-Using-Fleet/configuration-files/README.md
@@ -0,0 +1,34 @@
+# Configuration files
+
+Entities in Fleet, such as queries, packs, labels, agent options, and enroll secrets, can be managed with configuration files in yaml syntax.
+
+This page contains links to examples that can help you understand the configuration options for your Fleet yaml file(s).
+
+Examples in this directory are presented in two forms:
+- [`single-file-configuration.yml`](./single-file-configuration.yml) presents multiple yaml documents in one file. One file is often easier to manage than several. Group related objects into a single file whenever it makes sense.
+- The `multi-file-configuration` directory presents multiple yaml documents in separate files. They are in the following structure:
+
+```
+├─ packs
+├ └─ osquery-monitoring.yml
+├─ agent-options.yml
+├─ enroll-secrets.yml
+├─ labels.yml
+├─ queries.yml
+```
+
+## Using yaml files in Fleet
+
+A Fleet configuration is defined using one or more declarative "messages" in yaml syntax. Each message can live in it's own file or multiple in one file, each separated by `---`. Each file/message contains a few required top-level keys:
+
+- `apiVersion` - the API version of the file/request
+- `spec` - the "data" of the request
+- `kind ` - the type of file/object (i.e.: pack, query, config)
+
+The file may optionally also include some `metadata` for more complex data types (i.e.: packs).
+
+When you reason about how to manage these config files, consider following the [General Config Tips](https://kubernetes.io/docs/concepts/configuration/overview/#general-config-tips) published by the Kubernetes project. Some of the especially relevant tips are included here as well:
+
+- When defining configurations, specify the latest stable API version.
+- Configuration files should be stored in version control before being pushed to the cluster. This allows quick roll-back of a configuration if needed. It also aids with cluster re-creation and restoration if necessary.
+- Don’t specify default values unnecessarily – simple and minimal configs will reduce errors.
diff --git a/examples/kubernetes/fleet-deployment.yml b/docs/1-Using-Fleet/configuration-files/kubernetes/fleet-deployment.yml
similarity index 100%
rename from examples/kubernetes/fleet-deployment.yml
rename to docs/1-Using-Fleet/configuration-files/kubernetes/fleet-deployment.yml
diff --git a/examples/kubernetes/fleet-migrations.yml b/docs/1-Using-Fleet/configuration-files/kubernetes/fleet-migrations.yml
similarity index 100%
rename from examples/kubernetes/fleet-migrations.yml
rename to docs/1-Using-Fleet/configuration-files/kubernetes/fleet-migrations.yml
diff --git a/examples/kubernetes/fleet-service.yml b/docs/1-Using-Fleet/configuration-files/kubernetes/fleet-service.yml
similarity index 100%
rename from examples/kubernetes/fleet-service.yml
rename to docs/1-Using-Fleet/configuration-files/kubernetes/fleet-service.yml
diff --git a/examples/config-many-files/config.yml b/docs/1-Using-Fleet/configuration-files/multi-file-configuration/agent-options.yml
similarity index 100%
rename from examples/config-many-files/config.yml
rename to docs/1-Using-Fleet/configuration-files/multi-file-configuration/agent-options.yml
diff --git a/examples/config-many-files/enroll-secret.yml b/docs/1-Using-Fleet/configuration-files/multi-file-configuration/enroll-secrets.yml
similarity index 100%
rename from examples/config-many-files/enroll-secret.yml
rename to docs/1-Using-Fleet/configuration-files/multi-file-configuration/enroll-secrets.yml
diff --git a/examples/config-many-files/labels.yml b/docs/1-Using-Fleet/configuration-files/multi-file-configuration/labels.yml
similarity index 100%
rename from examples/config-many-files/labels.yml
rename to docs/1-Using-Fleet/configuration-files/multi-file-configuration/labels.yml
diff --git a/examples/config-many-files/packs/osquery-monitoring.yml b/docs/1-Using-Fleet/configuration-files/multi-file-configuration/packs/osquery-monitoring.yml
similarity index 100%
rename from examples/config-many-files/packs/osquery-monitoring.yml
rename to docs/1-Using-Fleet/configuration-files/multi-file-configuration/packs/osquery-monitoring.yml
diff --git a/examples/config-many-files/queries.yml b/docs/1-Using-Fleet/configuration-files/multi-file-configuration/queries.yml
similarity index 100%
rename from examples/config-many-files/queries.yml
rename to docs/1-Using-Fleet/configuration-files/multi-file-configuration/queries.yml
diff --git a/examples/config-single-file.yml b/docs/1-Using-Fleet/configuration-files/single-file-configuration.yml
similarity index 100%
rename from examples/config-single-file.yml
rename to docs/1-Using-Fleet/configuration-files/single-file-configuration.yml
diff --git a/docs/1-Using-Fleet/standard-query-library/README.md b/docs/1-Using-Fleet/standard-query-library/README.md
new file mode 100644
index 0000000000..4ead185ed7
--- /dev/null
+++ b/docs/1-Using-Fleet/standard-query-library/README.md
@@ -0,0 +1,39 @@
+# Standard query library
+
+Fleet's standard query library includes a growing collection of useful queries for organizations deploying Fleet and osquery.
+
+## Importing the queries in Fleet
+
+#### After cloning the fleetdm/fleet repo, import the queries using fleetctl:
+```
+fleetctl apply -f fleet/docs/1-Using-Fleet/standard-query-library/standard-query-library.yml
+```
+
+## Contributors
+
+Want to add your own query?
+
+1. Please copy the following yaml section and paste it at the bottom of the [`standard-query-library.yml`](./standard-query-library.yml) file.
+```yaml
+---
+apiVersion: v1
+kind: query
+spec:
+ name: What is your query called? Please use a human readable query name.
+ platforms: What operating systems support your query? This can usually be determined by the osquery tables included in your query. Heading to the https://osquery.io/schema webpage to see which operating systems are supported by the tables you include.
+ description: Describe your query. What does information does your query reveal?
+ query: Insert query here
+ purpose: What is the goal of running your query? Ex. Detection
+ remediation: Are there any remediation steps to resolve the detection triggered by your query? If not, insert "N/A."
+ contributors: zwass,mike-j-thomas
+```
+2. Replace each field and submit a pull request to the fleetdm/fleet GitHub repository.
+
+For instructions on submitting pull requests to Fleet check out [the Committing Changes section](https://github.com/fleetdm/fleet/blob/58445ede82550cb574775a83ae4cf5433f325a7e/docs/4-Contribution/4-Committing-Changes.md#committing-changes) in the Contributors documentation.
+
+## Additional resources
+
+Listed below are great resources that contain additional queries.
+
+- Osquery (https://github.com/osquery/osquery/tree/master/packs)
+- Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet)
diff --git a/docs/1-Using-Fleet/standard-query-library/standard-query-library.yml b/docs/1-Using-Fleet/standard-query-library/standard-query-library.yml
new file mode 100644
index 0000000000..c822af202b
--- /dev/null
+++ b/docs/1-Using-Fleet/standard-query-library/standard-query-library.yml
@@ -0,0 +1,250 @@
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Count Apple applications installed
+ platforms: macOS
+ description: Count the number of Apple applications installed on the machine.
+ query: SELECT COUNT(*) FROM apps WHERE bundle_identifier LIKE 'com.apple.%';
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Detect Linux hosts with high severity vulnerable versions of OpenSSL
+ platforms: Linux
+ description: Retrieves the OpenSSL version.
+ query: SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';
+ purpose: Detection
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Detect machines with Gatekeeper disabled
+ platforms: macOS
+ description: Gatekeeper tries to ensure only trusted software is run on a mac machine.
+ query: SELECT * FROM gatekeeper WHERE assessments_enabled = 0;
+ purpose: Detection
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Detect presence of authorized SSH keys
+ platforms: macOS, Linux
+ description: Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.
+ query: SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);
+ purpose: Detection
+ remediation: Check out the linked table (https://github.com/fleetdm/fleet/blob/32b4d53e7f1428ce43b0f9fa52838cbe7b413eed/handbook/queries/detect-hosts-with-high-severity-vulnerable-versions-of-openssl.md#table-of-vulnerable-openssl-versions) to determine if the installed version is a high severity vulnerability and view the corresponding CVE(s)
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get authorized keys
+ platforms: macOS, Linux
+ description: List authorized_keys for each user on the system.
+ query: SELECT * FROM users CROSS JOIN authorized_keys USING (uid);
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get crashes
+ platforms: macOS
+ description: Retrieve application, system, and mobile app crash logs.
+ query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed Chrome Extensions
+ platforms: macOS, Linux, Windows, FreeBSD
+ description: List installed Chrome Extensions for all users.
+ query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed FreeBSD software
+ platforms: FreeBSD
+ description: Get all software installed on a FreeBSD computer, including browser plugins and installed packages. Note, this does not included other running processes in the processes table.
+ query: SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Package (pkg)' AS type, 'pkg_packages' AS source FROM pkg_packages;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get Homebrew Packages
+ platforms: macOS
+ description: Get the installed homebrew package database.
+ query: SELECT * FROM homebrew_packages;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed Linux software
+ platforms: Linux
+ description: Get all software installed on a Linux computer, including browser plugins and installed packages. Note, this does not included other running processes in the processes table.
+ query: SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed macOS software
+ platforms: macOS
+ description: Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note, this does not included other running processes in the processes table.
+ query: SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed Safari extensions
+ platforms: macOS
+ description: Retrieves the list of installed Safari Extensions for all users in the target system.
+ query: SELECT safari_extensions.* FROM users join safari_extensions USING (uid);
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get installed Windows software
+ platforms: Windows
+ description: Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note, this does not included other running processes in the processes table.
+ query: SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get laptops with failing batteries
+ platforms: macOS
+ description:
+ query: SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get macOS disk free space percentage
+ platforms: macOS
+ description: Displays the percentage of free space available on the primary disk partition.
+ query: SELECT (blocks_available * 100 / blocks) AS pct, * FROM mounts WHERE path = '/';
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get macOS disk free space percentage
+ platforms: macOS
+ description: Displays the percentage of free space available on the primary disk partition.
+ query: SELECT (blocks_available * 100 / blocks) AS pct, * FROM mounts WHERE path = '/';
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get mounts
+ platforms: macOS, Linux
+ description: Shows system mounted devices and filesystems (not process specific).
+ query: SELECT device, device_alias, path, type, blocks_size FROM mounts;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get the version of the resident operating system
+ platforms: macOS, Linux, Windows, FreeBSD
+ description: Shows system mounted devices and filesystems (not process specific).
+ query: SELECT * FROM os_version;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get platform info
+ platforms: macOS
+ description: Shows information about the host platform
+ query: SELECT vendor, version, date, revision from platform_info;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get startup items
+ platforms: macOS, Linux, Windows, FreeBSD
+ description: Shows applications and binaries set as user/login startup items.
+ query: SELECT * FROM startup_items;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get system logins and logouts
+ platforms: macOS
+ description: Get a list of system logins and logouts.
+ query: SELECT * FROM last;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get system uptime
+ platforms: macOS, Linux, Windows, FreeBSD
+ description: Shows the system uptime.
+ query: SELECT * FROM uptime;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get USB devices
+ platforms: macOS, Linux
+ description: Shows all USB devices that are actively plugged into the host system.
+ query: SELECT * FROM usb_devices;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get wifi status
+ platforms: macOS
+ description: Shows information about the wifi network that a host is currently connected to.
+ query: SELECT * FROM wifi_status;
+ purpose: Informational
+ remediation: N/A
+---
+apiVersion: v1
+kind: query
+spec:
+ name: Get Windows machines with unencrypted hard disks
+ platforms: Windows
+ description:
+ query: SELECT * FROM bitlocker_info WHERE protection_status = 0;
+ purpose: Informational
+ remediation: N/A
diff --git a/docs/2-Orbit-osquery/README.md b/docs/2-Orbit-osquery/README.md
new file mode 100644
index 0000000000..bc094ae52c
--- /dev/null
+++ b/docs/2-Orbit-osquery/README.md
@@ -0,0 +1,152 @@
+# Orbit osquery
+
+Orbit is an [osquery](https://github.com/osquery/osquery) runtime and autoupdater. With Orbit, it's easy to deploy osquery, manage configurations, and stay up to date. Orbit eases the deployment of osquery connected with a [Fleet server](https://github.com/fleetdm/fleet), and is a (near) drop-in replacement for osquery in a variety of deployment scenarios.
+
+Orbit is the recommended agent for Fleet. But Orbit can be used with or without Fleet, and Fleet can be used with or without Orbit.
+
+## Usage
+
+General information and flag documentation can be accessed by running `orbit --help`.
+
+### Permissions
+
+Orbit generally expects root permissions to be able to create and access it's working files.
+
+To get root level permissions:
+
+#### macOS/Linux
+
+Prefix `orbit` commands with `sudo` (`sudo orbit ...`) or run in a root shell.
+
+#### Windows
+
+Run Powershell or cmd.exe with "Run as administrator" and start `orbit` commands from that shell.
+
+### Osquery shell
+
+Run an `osqueryi` shell with `orbit osqueryi` or `orbit shell`.
+
+### Connect to a Fleet server
+
+Use the `--fleet-url` and `--enroll-secret` flags to connect to a Fleet server.
+
+For example:
+
+``` sh
+orbit --fleet-url=https://localhost:8080 --enroll-secret=the_secret_value
+```
+
+Use `--fleet_certificate` to provide a path to a certificate bundle when necessary for osquery to verify the authenticity of the Fleet server (typically when using a Windows client or self-signed certificates):
+
+``` sh
+orbit --fleet-url=https://localhost:8080 --enroll-secret=the_secret_value --fleet-certificate=cert.pem
+```
+
+Add the `--insecure` flag for connections using otherwise invalid certificates:
+
+``` sh
+orbit --fleet-url=https://localhost:8080 --enroll-secret=the_secret_value --insecure
+```
+
+### Osquery flags
+
+Orbit can be used as near drop-in replacement for `osqueryd`, enhancing standard osquery with autoupdate capabilities. Orbit passes through any options after `--` directly to the `osqueryd` instance.
+
+For example, the following would be a typical drop-in usage of Orbit:
+
+``` sh
+orbit -- --flagfile=flags.txt
+```
+
+## Packaging
+
+Orbit, like standalone osquery, is typically deployed via OS-specific packages. Tooling is provided with this repository to generate installation packages.
+
+### Packaging support
+
+- **macOS** - `.pkg` package generation with (optional) [Notarization](https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution) and codesigning - Persistence via `launchd`.
+
+- **Linux** - `.deb` (Debian, Ubuntu, etc.) & `.rpm` (RHEL, CentOS, etc.) package generation - Persistence via `systemd`.
+
+- **Windows** (coming soon) - `.msi` package generation - Persistence via Services.
+
+### Building packages
+
+Before building packages, clone or download this repository and [install Go](https://golang.org/doc/install).
+
+Use `go run ./cmd/package` from this directory to run the packaging tools.
+
+The only required parameter is `--type`, use one of `deb`, `rpm`, or `pkg` (`msi` coming soon).
+
+Configure osquery to connect to a Fleet (or other TLS) server with the `--fleet-url` and `--enroll-secret` flags.
+
+A minimal invocation for communicating with Fleet:
+
+``` sh
+go run ./cmd/package --type deb --fleet-url=fleet.example.com --enroll-secret=notsosecret
+```
+
+This will build a `.deb` package configured to communicate with a Fleet server at `fleet.example.com` using the enroll secret `notsosecret`.
+
+When the Fleet server uses a self-signed (or otherwise invalid) TLS certificate, package with the `--insecure` or `--fleet-certificate` options.
+
+See `go run ./cmd/package` for the full range of packaging options.
+
+#### Update channels
+
+Orbit uses the concept of "update channels" to determine the version of Orbit, osquery, and any extensions (extension support coming soon) to run. This concept is modeled from the common versioning convention for Docker containers.
+
+Configure update channels for Orbit and osqueryd with the `--orbit-channel` and `--osqueryd-channel` flags when packaging.
+
+| Channel | Versions |
+| ------------------------------------ | ------ |
+| `4` | 4.x.x |
+| `4.6` | 4.6.x |
+| `4.6.0` | 4.6.0 |
+
+Additionally `stable` and `edge` are special channel names. `stable` will always return the version Fleet deems to be stable, while `edge` will provide newer releases for beta testing.
+
+#### macOS signing & Notarization
+
+Orbit's packager can automate the codesigning and Notarization steps to allow the resulting package to generate packages that appear "trusted" when install on macOS hosts. Signing & notarization are supported only on macOS hosts.
+
+For signing, a "Developer ID Installer" certificate must be available on the build machine ([generation instructions](https://help.apple.com/xcode/mac/current/#/dev154b28f09)). Use `security find-identity -v` to verify the existence of this certificate and make note of the identifier provided in the left column.
+
+For Notarization, valid App Store Connect credentials must be available on the build machine. Set these in the environment variables `AC_USERNAME` and `AC_PASSWORD`. It is common to configure this via [app-specific passwords](https://support.apple.com/en-ca/HT204397).
+
+Build a signed and notarized macOS package with an invocation like the following:
+
+``` sh
+AC_USERNAME=zach@fleetdm.com AC_PASSWORD=llpk-sije-kjlz-jdzw go run ./cmd/package --type=pkg --fleet-url=fleet.example.com --enroll-secret=63SBzTT+2UyW --sign-identity 3D7260BF99539C6E80A94835A8921A988F4E6498 --notarize
+```
+
+This process may take several minutes to complete as the Notarization process completes on Apple's servers.
+
+After successful notarization, the generated "ticket" is automatically stapled to the package.
+
+## FAQs
+
+### How does Orbit compare with Kolide Launcher?
+
+Orbit is inspired by the success of [Kolide Launcher](https://github.com/kolide/launcher), and approaches a similar problem domain with new strategies informed by the challenges encountered in real world deployments. Orbit does not share any code with Launcher.
+
+- Both Orbit and Launcher use [The Update Framework](https://theupdateframework.com/) specification for managing updates. Orbit utilizes the official [go-tuf](https://github.com/theupdateframework/go-tuf) library, while Launcher has it's own implementation of the specification.
+- Orbit can be deployed as a (near) drop-in replacement for osquery, supporting full customization of the osquery flags. Launcher heavily manages the osquery flags making deployment outside of Fleet or Kolide's SaaS difficult.
+- Orbit prefers the battle-tested plugins of osquery. Orbit uses the built-in logging, configuration, and live query plugins, while Launcher uses custom implementations.
+- Orbit prefers the built-in osquery remote APIs. Launcher utilizes a custom gRPC API that has led to issues with character encoding, load balancers/proxies, and request size limits.
+- Orbit encourages use of the osquery performance Watchdog, while Launcher disables the Watchdog.
+
+Additionally, Orbit aims to tackle problems out of scope for Launcher:
+
+- Configure updates via release channels, providing more granular control over agent versioning.
+- Support for deploying and updating osquery extensions (🔜).
+- Manage osquery versions and startup flags from a remote (Fleet) server (🔜).
+- Further control of osquery performance via cgroups (🔜).
+
+### Is Orbit Free?
+
+Yes! Orbit is licensed under an MIT license and all uses are encouraged.
+
+### How does orbit update osquery? And how do the stable and edge channels get triggered to update osquery on a self hosted Fleet instance?
+
+Orbit uses a configurable update server. We expect that many folks will just use the update server we manage (similar to what Kolide does with Launcher's update server). We are also offering [tooling for self-managing an update server](https://github.com/fleetdm/fleet/blob/master/docs/3-Deployment/4-fleetctl-agent-updates.md) as part of Fleet Basic (the subscription offering).
diff --git a/docs/2-Deployment/1-Installation.md b/docs/3-Deployment/1-Installation.md
similarity index 100%
rename from docs/2-Deployment/1-Installation.md
rename to docs/3-Deployment/1-Installation.md
diff --git a/docs/2-Deployment/2-Configuration.md b/docs/3-Deployment/2-Configuration.md
similarity index 96%
rename from docs/2-Deployment/2-Configuration.md
rename to docs/3-Deployment/2-Configuration.md
index 8b31cff321..edabb998a8 100644
--- a/docs/2-Deployment/2-Configuration.md
+++ b/docs/3-Deployment/2-Configuration.md
@@ -333,6 +333,19 @@ The database to use when connecting to the Redis instance.
redis:
database: 14
```
+
+###### `redis_duplicate_results`
+
+Whether or not to duplicate Live Query results to another Redis channel named `LQDuplicate`. This is useful in a scenario that would involve shipping the Live Query results outside of Fleet, near-realtime.
+
+- Default value: `false`
+- Environment variable: `FLEET_REDIS_DUPLICATE_RESULTS`
+- Config file format:
+
+ ```
+ redis:
+ duplicate_results: true
+ ```
##### Server
@@ -420,6 +433,21 @@ Note that some other configurations may need to be changed when modifying the UR
url_prefix: /apps/fleet
```
+###### `server_keepalive`
+
+Controls the server side http keep alive property.
+
+Turning off keepalives has helped reduce outstanding TCP connections in some deployments.
+
+- Default value: true
+- Environment variable: `FLEET_SERVER_KEEPALIVE`
+- Config file format:
+
+ ```
+ server:
+ keepalive: true
+ ```
+
##### Auth
###### `auth_jwt_key`
@@ -1168,6 +1196,28 @@ The identifier of the pubsub topic that osquery status logs will be published to
status_topic: osquery_status
```
+###### `pubsub_add_attributes`
+
+This flag only has effect if `osquery_status_log_plugin` is set to `pubsub`.
+
+Add Pub/Sub attributes to messages. When enabled, the plugin parses the osquery result
+messages, and adds the following Pub/Sub message attributes:
+
+- `name` - the `name` attribute from the message body
+- `timestamp` - the `unixTime` attribute from the message body, converted to rfc3339 format
+- Each decoration from the message
+
+This feature is useful when combined with [subscription filters](https://cloud.google.com/pubsub/docs/filtering).
+
+- Default value: false
+- Environment variable: `FLEET_PUBSUB_ADD_ATTRIBUTES`
+- Config file format:
+
+ ```
+ pubsub:
+ status_topic: osquery_status
+ ```
+
##### S3 file carving backend
###### `s3_bucket`
diff --git a/docs/2-Deployment/3-Adding-hosts.md b/docs/3-Deployment/3-Adding-hosts.md
similarity index 100%
rename from docs/2-Deployment/3-Adding-hosts.md
rename to docs/3-Deployment/3-Adding-hosts.md
diff --git a/docs/2-Deployment/4-Example-deployment-scenarios.md b/docs/3-Deployment/4-Example-deployment-scenarios.md
similarity index 97%
rename from docs/2-Deployment/4-Example-deployment-scenarios.md
rename to docs/3-Deployment/4-Example-deployment-scenarios.md
index f9ba2e7e2a..a99fac5a6d 100644
--- a/docs/2-Deployment/4-Example-deployment-scenarios.md
+++ b/docs/3-Deployment/4-Example-deployment-scenarios.md
@@ -447,14 +447,14 @@ We will use this address when we configure the Kubernetes deployment and databas
The last step is to run the Fleet database migrations on your new MySQL server. To do this, run the following:
```
-kubectl create -f ./examples/kubernetes/fleet-migrations.yml
+kubectl create -f ./docs/1-Using-Fleet/configuration-files/kubernetes/fleet-migrations.yml
```
In Kubernetes, you can only run a job once. If you'd like to run it again (i.e.: you'd like to run the migrations again using the same file), you must delete the job before re-creating it. To delete the job and re-run it, you can run the following commands:
```
-kubectl delete -f ./examples/kubernetes/fleet-migrations.yml
-kubectl create -f ./examples/kubernetes/fleet-migrations.yml
+kubectl delete -f ./docs/1-Using-Fleet/configuration-files/kubernetes/fleet-migrations.yml
+kubectl create -f ./docs/1-Using-Fleet/configuration-files/kubernetes/fleet-migrations.yml
```
#### Redis
@@ -523,7 +523,7 @@ kubectl create secret generic fleet-server-auth-key --from-file=./build/fleet-se
First we must deploy the instances of the Fleet webserver. The Fleet webserver is described using a Kubernetes deployment object. To create this deployment, run the following:
```
-kubectl apply -f ./examples/kubernetes/fleet-deployment.yml
+kubectl apply -f ./docs/1-Using-Fleet/configuration-files/kubernetes/fleet-deployment.yml
```
You should be able to get an instance of the webserver running via `kubectl get pods` and you should see the following logs:
@@ -539,7 +539,7 @@ ts=2017-11-16T02:48:38.441148166Z transport=https address=0.0.0.0:443 msg=listen
Now that the Fleet server is running on our cluster, we have to expose the Fleet webservers to the internet via a load balancer. To create a Kubernetes `Service` of type `LoadBalancer`, run the following:
```
-kubectl apply -f ./examples/kubernetes/fleet-service.yml
+kubectl apply -f ./docs/1-Using-Fleet/configuration-files/kubernetes/fleet-service.yml
```
#### Configure DNS
diff --git a/docs/2-Deployment/4-fleetctl-agent-updates.md b/docs/3-Deployment/4-fleetctl-agent-updates.md
similarity index 100%
rename from docs/2-Deployment/4-fleetctl-agent-updates.md
rename to docs/3-Deployment/4-fleetctl-agent-updates.md
diff --git a/docs/2-Deployment/FAQ.md b/docs/3-Deployment/FAQ.md
similarity index 98%
rename from docs/2-Deployment/FAQ.md
rename to docs/3-Deployment/FAQ.md
index a8184ca7b7..0de639071f 100644
--- a/docs/2-Deployment/FAQ.md
+++ b/docs/3-Deployment/FAQ.md
@@ -47,6 +47,8 @@ Osquery requires that all communication between the agent and Fleet are over a s
This error usually indicates that the Fleet server has run out of file descriptors. Fix this by increasing the `ulimit` on the Fleet process. See the `LimitNOFILE` setting in the [example systemd unit file](./2-Configuration.md#runing-with-systemd) for an example of how to do this with systemd.
+Some deployments may benefit by setting the [`--server_keepalive`](./2-Configuration.md#server_keepalive) flag to false.
+
## I upgraded my database, but Fleet is still running slowly. What could be going on?
This could be caused by a mismatched connection limit between the Fleet server and the MySQL server that prevents Fleet from fully utilizing the database. First [determine how many open connections your MySQL server supports](https://dev.mysql.com/doc/refman/8.0/en/too-many-connections.html). Now set the [`--mysql_max_open_conns`](./2-Configuration.md#mysql_max_open_conns) and [`--mysql_max_idle_conns`](./2-Configuration.md#mysql_max_idle_conns) flags appropriately.
diff --git a/docs/2-Deployment/README.md b/docs/3-Deployment/README.md
similarity index 100%
rename from docs/2-Deployment/README.md
rename to docs/3-Deployment/README.md
diff --git a/docs/3-Contribution/1-Building-Fleet.md b/docs/4-Contribution/1-Building-Fleet.md
similarity index 100%
rename from docs/3-Contribution/1-Building-Fleet.md
rename to docs/4-Contribution/1-Building-Fleet.md
diff --git a/docs/3-Contribution/2-Testing.md b/docs/4-Contribution/2-Testing.md
similarity index 100%
rename from docs/3-Contribution/2-Testing.md
rename to docs/4-Contribution/2-Testing.md
diff --git a/docs/3-Contribution/3-Migrations.md b/docs/4-Contribution/3-Migrations.md
similarity index 100%
rename from docs/3-Contribution/3-Migrations.md
rename to docs/4-Contribution/3-Migrations.md
diff --git a/docs/3-Contribution/4-Committing-Changes.md b/docs/4-Contribution/4-Committing-Changes.md
similarity index 100%
rename from docs/3-Contribution/4-Committing-Changes.md
rename to docs/4-Contribution/4-Committing-Changes.md
diff --git a/docs/3-Contribution/5-Releasing-Fleet.md b/docs/4-Contribution/5-Releasing-Fleet.md
similarity index 100%
rename from docs/3-Contribution/5-Releasing-Fleet.md
rename to docs/4-Contribution/5-Releasing-Fleet.md
diff --git a/docs/3-Contribution/FAQ.md b/docs/4-Contribution/FAQ.md
similarity index 100%
rename from docs/3-Contribution/FAQ.md
rename to docs/4-Contribution/FAQ.md
diff --git a/docs/3-Contribution/README.md b/docs/4-Contribution/README.md
similarity index 100%
rename from docs/3-Contribution/README.md
rename to docs/4-Contribution/README.md
diff --git a/docs/README.md b/docs/README.md
index 68b906da59..6e152ad0d5 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -3,12 +3,15 @@
Welcome to the documentation for the Fleet osquery fleet manager.
### [Using Fleet](./1-Using-Fleet/README.md)
-Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API
+Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API.
-### [Deployment](./2-Deployment/README.md)
-Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios
+### [Orbit osquery](./2-Orbit-osquery/README.md)
+Resources for using Orbit for osquery: the recommended agent for Fleet.
-### [Contribution](./3-Contribution/README.md)
+### [Deployment](./3-Deployment/README.md)
+Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios.
+
+### [Contribution](./4-Contribution/README.md)
If you're interested in interacting with the Fleet source code, you'll find information on modifying and building the code here.
---
diff --git a/frontend/README.md b/frontend/README.md
index a826dd477f..88d42027da 100644
--- a/frontend/README.md
+++ b/frontend/README.md
@@ -5,7 +5,7 @@ The Fleet front-end is a Single Page Application using React and Redux.
## Running the Fleet web app
For details instruction on building and serving the Fleet web application
-consult the [Contribution documentation](../docs/3-Contribution/README.md)
+consult the [Contribution documentation](../docs/4-Contribution/README.md)
## Directory Structure
diff --git a/frontend/components/LoginRoutes/_styles.scss b/frontend/components/LoginRoutes/_styles.scss
index 90b9e1c35c..3db8a8804a 100644
--- a/frontend/components/LoginRoutes/_styles.scss
+++ b/frontend/components/LoginRoutes/_styles.scss
@@ -5,5 +5,5 @@
justify-content: center;
position: relative;
min-height: 100vh;
- background-color: $gradients-dark-gradient;
+ background-color: $gradients-dark-gradient-vertical;
}
diff --git a/frontend/components/buttons/DropdownButton/DropdownButton.jsx b/frontend/components/buttons/DropdownButton/DropdownButton.jsx
index 82b06dcf43..db81ffe59b 100644
--- a/frontend/components/buttons/DropdownButton/DropdownButton.jsx
+++ b/frontend/components/buttons/DropdownButton/DropdownButton.jsx
@@ -93,7 +93,7 @@ export class DropdownButton extends Component {
return (
All trademarks, service marks, and company names are the property of their respective owners.
@@ -226,6 +231,7 @@
+
<% /* Display an overlay if the current browser is not supported.
diff --git a/website/views/pages/contact.ejs b/website/views/pages/contact.ejs
index d1ed43b775..af62062579 100644
--- a/website/views/pages/contact.ejs
+++ b/website/views/pages/contact.ejs
@@ -1,40 +1,56 @@
-
Get in touch
-
Have a question for us? Maybe some feedback? We love talking to users about NEW_APP_NAME, and we're happy to answer questions about our pricing, roadmap, or business solutions. Send us a note and we'll get back to you as soon as possible.
-
+
Contact our team
+
We're here to answer your questions, and familiarize you with Fleet.
-
-
-
Please let us know what to call you.
+
+
+
+
+
Please let us know what to call you.
+
+
+
+
+
Please let us know what to call you.
+
+
-
-
+
+
Please enter a valid email address.
-
-
-
Please choose a topic for your message.
+
+
+
+
+
Please choose a topic for your message.
-
+
Message cannot be empty.
+
Fields marked with an asterisk (*) are required.
-
- Send message
+
+ Submit
-
-
Thanks for reaching out!
-
-
We have received your message, and someone from our team will get back to you soon.
+
+
Thank you, {{formData.firstName}}!
+
We’re happy to hear from you. A member of our team will get back to you soon - usually within 1 business day (or less!).
"Fleet is hands down the best osquery platform out there. Zach and I created Fleet as a natural extension to our original vision for osquery and this has manifested in the ease-of-use, flexibility, and adoption it has today. Look to Fleet for the future of open-source endpoint monitoring."
-
- Mike Arpaia, Co-creator of osquery
-
-
-
-
-
Send device data to any log destination.
Fleet makes it easier to query and track your servers, containers, and laptops. It extends osquery to answer questions about multiple devices at the same time and provides log streams that enable automated threat detection.
-
+
Filesystem
@@ -124,82 +114,97 @@
-
+
- “
-
I've been using Fleet to manage thousands of hosts running osquery. Fleet itself is pretty low-maintenance; mostly I don't have to worry about Fleet uptime and instead focus on what matters: deploying osquery, developing better queries, and getting the most out of osquery logs.
-
- Brendan Shaklovitz, Senior Site Reliability Engineer, Security Team @ Atlassian
-
+
+
“I've been using Fleet to manage thousands of hosts running osquery: deploying, developing better queries, and getting the most out of osquery logs.”