Documentation changes for v4.67.0 (#28528)
Docs for the 4.67.0 release. --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: Eugene <eugene@fleetdm.com> Co-authored-by: Ian Littman <iansltx@gmail.com> Co-authored-by: Drew Baker <89049099+Drew-P-drawers@users.noreply.github.com> Co-authored-by: Scott Gress <scottmgress@gmail.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
This commit is contained in:
Rachael Shaw
co-authored by
Noah Talerman
Marko Lisica
Eugene
Ian Littman
Drew Baker
Scott Gress
Lucas Manuel Rodriguez
Martin Angers
Noah Talerman
Marko Lisica
Eugene
Ian Littman
Drew Baker
Scott Gress
Lucas Manuel Rodriguez
Martin Angers
parent
10a1e9c9c6
commit
7ae8b9a3da
@@ -27,7 +27,9 @@ The `--type` flag is used to specify the fleetd installer type.
|
||||
|
||||
A `--fleet-url` (Fleet instance URL) and `--enroll-secret` (Fleet enrollment secret) must be specified in order to communicate with Fleet instance.
|
||||
|
||||
To build an installer for ARM-based Linux, use the `--arch=arm64` flag with fleetctl.
|
||||
To generate fleetd for an Arm Linux or Windows host, use the `--arch=arm64` flag.
|
||||
|
||||
> **Fleetd for Arm Windows is an experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
|
||||
|
||||
#### Example
|
||||
|
||||
|
||||
@@ -1,9 +1,5 @@
|
||||
# Fleet 4.65.0 | GitOps mode, automatically install software, certificates in host vitals
|
||||
|
||||
<div purpose="embedded-content">
|
||||
<iframe src="https://www.youtube.com/embed/z7pbLb9kp1c?si=xPhedv5F46oR8YR-" frameborder="0" allowfullscreen></iframe>
|
||||
</div>
|
||||
|
||||
Fleet 4.65.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.65.0) or continue reading to get the highlights.
|
||||
For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
|
||||
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
# Foreign vitals: map IdP users to hosts
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
To add IdP host vitals, like the end user's groups and full name, follow steps for your IdP.
|
||||
|
||||
Fleet currently supports [Okta](#okta). [Microsoft Active Directory (AD) / Entra ID](#microsoft-entra-id), [Google Workspace](#google-workspace), and [authentik](#google-workspace), are coming soon.
|
||||
|
||||
|
||||
## Okta
|
||||
|
||||
To map users from Okta to hosts in Fleet, do the following steps:
|
||||
|
||||
- [Create application in Okta](#step-1-create-application-in-okta)
|
||||
- [Connect Okta to Fleet](#step-2-connect-okta-to-fleet)
|
||||
- [Map users and groups to hosts in Fleet](#step-3-map-users-and-groups-to-hosts-in-fleet)
|
||||
|
||||
#### Step 1: Create application in Okta
|
||||
|
||||
1. Head to Okta admin dashboard.
|
||||
2. In the main menu, select **Applications > Applications**, then select **Create App Integration**.
|
||||
3. Select **SAML 2.0** option and select **Next**.
|
||||
4. On the **General Settings** page, add a friendly **App name** (e.g Fleet SCIM), and select **Next**.
|
||||
5. On the **SAML Settings** page, add any URL to the **Single sign-on URL** and **Audience URI (SP Entity ID)** fields, and select **Next**.
|
||||
> Okta requires us to setup SAML settings in order to setup a SCIM integration. Since we don't need SAML right now, you can set the URL to anything like "example.fleetdm.com".
|
||||
6. On the **Feedback** page, provide feedback if you want, and select **Finish**.
|
||||
7. Select the **General** tab in your newly created app and then select **Edit** in **App Settings**.
|
||||
8. For **Provisioning**, select **SCIM** and select **Save**.
|
||||
|
||||
#### Step 2: Connect Okta to Fleet
|
||||
|
||||
1. Select the **Provisioning** tab and then, in **SCIM Connection**, select **Edit**.
|
||||
2. For the **SCIM connector base URL**, enter `https://<your_fleet_server_url>/api/v1/fleet/scim`.
|
||||
3. For the **Unique identifier field for users**, enter `userName`.
|
||||
4. For the **Supported provisioning actions**, select **Push New Users**, **Push Profile Updates**, and **Push Groups**.
|
||||
5. For the **Authentication Mode**, select **HTTP Header**.
|
||||
6. Create a Fleet API-only user with maintainer permissions and copy API token for that user (learn how [here](https://fleetdm.com/guides/fleetctl#create-api-only-user)). Paste your API token in Okta's **Authorization** field.
|
||||
7. Select the **Test Connector Configuration** button. You should see success message in Okta.
|
||||
8. In Fleet, head to **Settings > Integrations > Identity provider (IdP)** and verify that Fleet successfully received the request from IdP.
|
||||
9. Back in Okta, select **Save**.
|
||||
10. Under the **Provisioning** tab, select **To App** and then select **Edit** in the **Provisioning to App** section. Enable **Create Users**, **Update User Attributes**, **Deactivate Users**, and then select **Save**.
|
||||
11. On the same page, make sure that `givenName` and `familyName` have Okta value assigned to it. Currently, Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes.
|
||||
|
||||
|
||||
|
||||
#### Step 3: Map users and groups to hosts in Fleet
|
||||
|
||||
To send users and groups information to Fleet, you have to assign them to your new SCIM app.
|
||||
|
||||
1. In OKta's main menu **Directory > Groups** and then select **Add group**. Name it "Fleet human-device mapping".
|
||||
2. On the same page, select the **Rules** tab. Create a rule that will assign users to your "Fleet human-device mapping" group.
|
||||
|
||||
3. In the main menu, select **Applications > Applications** and select your new SCIM app. Then, select the **Assignments** tab.
|
||||
4. Select **Assign > Assign to Groups** and then select **Assign** next to the "Fleet human-device mapping" group. Then, select **Done**. Now all users that you assigned to the "Fleet human-device mapping" group will be provisioned to Fleet.
|
||||
5. On the same page, select **Push Groups** tab. Then, select **Push Groups > Find groups by name** and add all groups that you assigned to "Fleet human-device mapping" group previously (make sure that **Push group memberships immediately** is selected). All groups will be provisioned in Fleet, and Fleet will map those groups to users.
|
||||
|
||||
## Verify connection
|
||||
|
||||
After following steps above, you should be able to see latest requests from your IdP to Fleet if you navigate to **Settings > Integrations > Identity Provider (IdP)**.
|
||||
|
||||
To verify that user information is added to a host, go to the host that has IdP username assigned, and verify that **Full name (IdP)** and **Groups (IdP)** are populated correctly.
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
If you find that information from IdP (e.g full name or groups) is missing on the host, and host has IdP username assigned to it, follow steps below to resolve.
|
||||
|
||||
1. Please first go to Okta, select **Directory > People**, find user that is
|
||||
missing information and make sure that it has all fields required by Fleet (username, first name, and
|
||||
last name).
|
||||
2. If all required fields are present, then go to **Applications > Applications > fleet_scim_application > Provisioning > To App**, then scroll on the bottom of the page and make sure that `userName`, `givenName`, and `familyName` has value assigned to it.
|
||||
3. Otherwise make sure that all settings from instructions above were set correctly.
|
||||
|
||||
<meta name="authorGitHubUsername" value="marko-lisica">
|
||||
<meta name="authorFullName" value="Marko Lisica">
|
||||
<meta name="publishedOn" value="2025-04-11">
|
||||
<meta name="articleTitle" value="Foreign vitals: map IdP users to hosts">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/add-users-from-idp-cover-img.png">
|
||||
<meta name="category" value="guides">
|
||||
@@ -36,6 +36,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
|
||||
| **Action** | Observer | Observer+* | Maintainer | Admin | GitOps* |
|
||||
| ------------------------------------------------------------------------------------------------------------------------------------------ | :------: | :--------: | :--------: | :---: | :-----: |
|
||||
| View all [activity](https://fleetdm.com/docs/using-fleet/rest-api#activities) | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Cancel [hosts' upcoming activity](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) | | | ✅ | ✅ | |
|
||||
| Manage [activity automations](https://fleetdm.com/docs/using-fleet/audit-logs) | | | | ✅ | ✅ |
|
||||
| View all hosts | ✅ | ✅ | ✅ | ✅ | |
|
||||
| View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ |
|
||||
@@ -44,6 +45,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
|
||||
| Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ |
|
||||
| Add and delete hosts | | | ✅ | ✅ | |
|
||||
| Transfer hosts between teams\* | | | ✅ | ✅ | ✅ |
|
||||
| Add user information from IdP to hosts\* | | | ✅ | ✅ | |
|
||||
| Create, edit, and delete labels | | | ✅ | ✅ | ✅ |
|
||||
| View all software | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Add, edit, and delete software | | | ✅ | ✅ | ✅ |
|
||||
@@ -129,6 +131,8 @@ Users with access to multiple teams can be assigned different roles for each tea
|
||||
| View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ |
|
||||
| Filter hosts using [labels](https://fleetdm.com/docs/using-fleet/rest-api#labels) | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Target hosts using labels | ✅ | ✅ | ✅ | ✅ | |
|
||||
| View hosts' [past](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity) and [upcoming](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) activity | ✅ | ✅ | ✅ | ✅ | |
|
||||
| Cancel hosts' [upcoming](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) activity | | | ✅ | ✅ | |
|
||||
| Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ |
|
||||
| Create and edit self-authored labels | | | | | ✅ |
|
||||
| Add and delete hosts | | | ✅ | ✅ | |
|
||||
|
||||
@@ -19,7 +19,7 @@ Whether you are using Fleet alongside Jamf Pro to manage your Apple devices or p
|
||||
| MDM enrolled | MDM enabled | MDM is a feature of Fleet. Hosts can be enrolled in Fleet without MDM enabled. You can get the benefits of Fleet while keeping your devices MDM enrolled with another solution. |
|
||||
| Configuration Profiles | Custom settings | Controls > OS settings > Custom settings |
|
||||
| Enrollment customization | Setup experience | Controls > Setup experience |
|
||||
| Cloud identity providers | Single sign-on options | Settings > Single sign-on options |
|
||||
| Cloud identity providers | Single sign-on (SSO) | Settings > Single sign-on (SSO) |
|
||||
| App installers | Fleet-maintained apps | |
|
||||
| Check-in Frequency | Agent options | |
|
||||
| App updates | Policy automation | |
|
||||
|
||||
@@ -18,6 +18,18 @@ To reduce the barrier of entry with Fleet, we’ve introduced our [standard temp
|
||||
|
||||
5. By default, policies are evaluated on an hourly interval, which is controlled by this [server setting](https://fleetdm.com/docs/configuration/fleet-server-configuration#osquery-policy-update-interval). Please see [this article](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies) for more information.
|
||||
|
||||
## Targeting hosts using platforms
|
||||
|
||||
When creating or editing a policy, you can restrict the set of hosts it will run on by selecting one or more _platforms_ listed in the **Target** section. The policy will only be applied to hosts that run one of the selected platforms. For example, if only MacOS and Linux are selected, then the policy will not run on Windows or ChromeOS hosts. When you first create a policy, Fleet will attempt to automatically select all of the platforms that have the ability to run the related query.
|
||||
|
||||
## Targeting hosts using labels
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
You can further restrict the set of hosts that a policy runs on by using [labels](https://fleetdm.com/guides/managing-labels-in-fleet). By default, a new policy will target all hosts of the selected platforms (see [Targeting hosts using platforms](https://fleetdm.com/docs/configuration/what-are-fleet-policies#targeting-hosts-using-labels) above), indicated by the **All Hosts** option being selected beneath the **Target** setting. If you select **Custom** instead, you will be able to select one or more labels for the policy to target. You can elect to have the policy run on hosts that match any of the selected labels by selecting "Include Any" from the provided dropdown. To instead _exclude_ hosts from running the policy if they match any of the selected labels, switch the dropdown to "Exclude any".
|
||||
|
||||
To learn more about labels, see [Managing labels in Fleet](https://fleetdm.com/guides/managing-labels-in-fleet).
|
||||
|
||||
## Identifying out-of-policy devices
|
||||
|
||||
The policies page makes it easy to see which devices on each team are passing and failing with distinct “yes” or “no” responses. Although checking devices manually is relatively easy, we’ve made it even easier for endpoint detection and response security. We now have automation.
|
||||
|
||||
@@ -2773,6 +2773,20 @@ The content of the Windows WSTEP identity key. An RSA private key, PEM-encoded.
|
||||
-----END RSA PRIVATE KEY-----
|
||||
```
|
||||
|
||||
## Partnerships
|
||||
|
||||
### partnerships_enable_secureframe
|
||||
|
||||
When enabled, end user's who select **Fleet Desktop > About Fleet** will be navigated to the fleetdm.com/better page with [Secureframe](https://secureframe.com/) branding. See the page here: https://fleetdm.com/better?utm_content=secureframe
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_PARTNERSHIPS_ENABLE_SECUREFRAME`
|
||||
- Config file format:
|
||||
```
|
||||
partnerships:
|
||||
enable_secureframe: true
|
||||
```
|
||||
|
||||
<h2 id="running-with-systemd">Running with systemd</h2>
|
||||
|
||||
This content was moved to [Systemd](http://fleetdm.com/docs/deploy/system-d) on Sept 6th, 2023.
|
||||
|
||||
@@ -101,6 +101,9 @@ policies:
|
||||
query: SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.';
|
||||
platform: darwin
|
||||
critical: false
|
||||
labels_include_any:
|
||||
- Engineering
|
||||
- Customer Support
|
||||
```
|
||||
|
||||
#### Separate file
|
||||
@@ -658,6 +661,8 @@ In addition, you can configure your certificate authorities (CA) to help your en
|
||||
|
||||
#### Example
|
||||
|
||||
`default.yml`
|
||||
|
||||
```yaml
|
||||
org_settings:
|
||||
integrations:
|
||||
|
||||
@@ -4535,6 +4535,9 @@ Content-Disposition: attachment
|
||||
Content-Length: <length>
|
||||
Body: <blob>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Users
|
||||
|
||||
### Update user-specific UI settings
|
||||
|
||||
@@ -1706,6 +1706,7 @@ This activity contains the following fields:
|
||||
|
||||
Generated when upcoming activity `installed_software` is canceled.
|
||||
|
||||
|
||||
This activity contains the following fields:
|
||||
- "host_id": ID of the host.
|
||||
- "host_display_name": Display name of the host.
|
||||
@@ -1716,10 +1717,10 @@ This activity contains the following fields:
|
||||
|
||||
```json
|
||||
{
|
||||
"host_id": 1,
|
||||
"host_display_name": "Anna's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
"host_id": 123,
|
||||
"host_display_name": "Marko's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
}
|
||||
```
|
||||
|
||||
@@ -1737,16 +1738,16 @@ This activity contains the following fields:
|
||||
|
||||
```json
|
||||
{
|
||||
"host_id": 1,
|
||||
"host_display_name": "Anna's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
"host_id": 123,
|
||||
"host_display_name": "Marko's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
}
|
||||
```
|
||||
|
||||
## canceled_install_app_store_app
|
||||
|
||||
Generated when upcoming activity `installed_app_store_app` is canceled.
|
||||
Generated when upcoming activity `installed_app_store_app` is canceled.
|
||||
|
||||
This activity contains the following fields:
|
||||
- "host_id": ID of the host.
|
||||
@@ -1758,14 +1759,13 @@ This activity contains the following fields:
|
||||
|
||||
```json
|
||||
{
|
||||
"host_id": 123,
|
||||
"host_display_name": "Anna's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
"host_id": 123,
|
||||
"host_display_name": "Anna's MacBook Pro",
|
||||
"software_title": "Adobe Acrobat.app",
|
||||
"software_title_id": 12334
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
<meta name="title" value="Audit logs">
|
||||
<meta name="pageOrderInSection" value="1400">
|
||||
<meta name="description" value="Learn how Fleet logs administrative actions in JSON format.">
|
||||
|
||||
@@ -342,7 +342,7 @@ Fleet's `docker-compose` file includes a SAML identity provider (IdP) for testin
|
||||
|
||||
### Configuration
|
||||
|
||||
Configure SSO on the Organization Settings page with the following:
|
||||
Configure SSO on the **Integration settings** page with the following:
|
||||
|
||||
```
|
||||
Identity Provider Name: SimpleSAML
|
||||
|
||||
@@ -139,7 +139,7 @@ After supplying the above information, your IdP will generate an issuer URI and
|
||||
|
||||
## Fleet configuration
|
||||
|
||||
To configure SSO in Fleet head to **Settings > Organization settings > Single sign-on options**.
|
||||
To configure SSO in Fleet head to **Settings > Integrations > Single sign-on (SSO)**.
|
||||
|
||||
If you're configuring end user authentication head to **Settings > Integrations > Automatic enrollment > End user authentication**.
|
||||
|
||||
@@ -165,7 +165,7 @@ The new account's email and full name are copied from the user data in the SSO r
|
||||
By default, accounts created via JIT provisioning are assigned the [Global Observer role](https://fleetdm.com/docs/using-fleet/permissions).
|
||||
To assign different roles for accounts created via JIT provisioning see [Customization of user roles](#customization-of-user-roles) below.
|
||||
|
||||
To enable this option, go to **Settings > Organization settings > Single sign-on options** and check "_Create user and sync permissions on login_" or [adjust your config](#sso-settings-enable-jit-provisioning).
|
||||
To enable this option, go to **Settings > Integrations > Single sign-on (SSO)** and check "_Create user and sync permissions on login_" or [adjust your config](#sso-settings-enable-jit-provisioning).
|
||||
|
||||
For this to work correctly make sure that:
|
||||
|
||||
|
||||
+128
-114
@@ -2257,6 +2257,7 @@ None.
|
||||
- [Wipe host](#wipe-host)
|
||||
- [Get host's past activity](#get-hosts-past-activity)
|
||||
- [Get host's upcoming activity](#get-hosts-upcoming-activity)
|
||||
- [Cancel host's upcoming activity](#cancel-hosts-upcoming-activity)
|
||||
- [Add labels to host](#add-labels-to-host)
|
||||
- [Remove labels from host](#remove-labels-from-host)
|
||||
- [Live query one host (ad-hoc)](#live-query-one-host-ad-hoc)
|
||||
@@ -2895,6 +2896,28 @@ Returns the information of the specified host.
|
||||
"shell": "/bin/zsh"
|
||||
}
|
||||
],
|
||||
"end_users": [
|
||||
{
|
||||
"idp_info_updated_at": "2025-03-20T02:02:17Z",
|
||||
"idp_id": "f26f8649-1e25-42c5-be71-1b1e6de56d3d",
|
||||
"idp_username": "anna@acme.com",
|
||||
"idp_full_name": "Anna Chao",
|
||||
"idp_groups": [
|
||||
"Product",
|
||||
"Designers"
|
||||
],
|
||||
"other_emails": [
|
||||
{
|
||||
"email": "anna@example.com",
|
||||
"source": "google_chrome_profiles"
|
||||
},
|
||||
{
|
||||
"email": "anna@example.com",
|
||||
"source": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"labels": [
|
||||
{
|
||||
"created_at": "2021-08-19T02:02:17Z",
|
||||
@@ -3026,6 +3049,8 @@ Returns the information of the specified host.
|
||||
> - `fleet_desktop_version: ""` means this agent is a fleetd agent but does not have fleet desktop
|
||||
> - `scripts_enabled: null` means this agent is not a fleetd agent, or this agent is version <=1.23.0 which is not collecting the scripts enabled info
|
||||
|
||||
> Note: [Get human-device mapping](https://github.com/fleetdm/fleet/blob/62dc32454f6a40e81fe229abdfc370d3bf7a56c6/docs/REST%20API/rest-api.md?plain=1#L3518) and [Update custom human-device mapping endpoints](https://github.com/fleetdm/fleet/blob/62dc32454f6a40e81fe229abdfc370d3bf7a56c6/docs/REST%20API/rest-api.md?plain=1#L3564) are deprecated. End user information is available as part of the [Get host](#get-host) endpoint.
|
||||
|
||||
### Get host by identifier
|
||||
|
||||
Returns the information of the host specified using the `hostname`, `uuid`, or `hardware_serial` as an identifier.
|
||||
@@ -3635,100 +3660,6 @@ Request (`filters` is specified and empty, to delete all hosts):
|
||||
|
||||
`Status: 200`
|
||||
|
||||
### Get human-device mapping
|
||||
|
||||
Returns the end user's email(s) they use to log in to their Identity Provider (IdP) and Google Chrome profile.
|
||||
|
||||
Also returns the custom email that's set via the `PUT /api/v1/fleet/hosts/:id/device_mapping` endpoint (docs [here](#update-custom-human-device-mapping))
|
||||
|
||||
Note that IdP email is only supported on macOS hosts. It's collected once, during automatic enrollment (DEP), only if the end user authenticates with the IdP and the DEP profile has `await_device_configured` set to `true`.
|
||||
|
||||
`GET /api/v1/fleet/hosts/:id/device_mapping`
|
||||
|
||||
#### Parameters
|
||||
|
||||
| Name | Type | In | Description |
|
||||
| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- |
|
||||
| id | integer | path | **Required**. The host's `id`. |
|
||||
|
||||
#### Example
|
||||
|
||||
`GET /api/v1/fleet/hosts/1/device_mapping`
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 200`
|
||||
|
||||
```json
|
||||
{
|
||||
"host_id": 1,
|
||||
"device_mapping": [
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "mdm_idp_accounts"
|
||||
},
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "google_chrome_profiles"
|
||||
},
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Update custom human-device mapping
|
||||
|
||||
`PUT /api/v1/fleet/hosts/:id/device_mapping`
|
||||
|
||||
Updates the email for the `custom` data source in the human-device mapping. This source can only have one email.
|
||||
|
||||
#### Parameters
|
||||
|
||||
| Name | Type | In | Description |
|
||||
| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- |
|
||||
| id | integer | path | **Required**. The host's `id`. |
|
||||
| email | string | body | **Required**. The custom email. |
|
||||
|
||||
#### Example
|
||||
|
||||
`PUT /api/v1/fleet/hosts/1/device_mapping`
|
||||
|
||||
##### Request body
|
||||
|
||||
```json
|
||||
{
|
||||
"email": "user@example.com"
|
||||
}
|
||||
```
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 200`
|
||||
|
||||
```json
|
||||
{
|
||||
"host_id": 1,
|
||||
"device_mapping": [
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "mdm_idp_accounts"
|
||||
},
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "google_chrome_profiles"
|
||||
},
|
||||
{
|
||||
"email": "user@example.com",
|
||||
"source": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Get host's device health report
|
||||
|
||||
@@ -4632,6 +4563,25 @@ To wipe a macOS, iOS, iPadOS, or Windows host, the host must have MDM turned on.
|
||||
}
|
||||
```
|
||||
|
||||
### Cancel host's upcoming activity
|
||||
|
||||
`DELETE /api/v1/fleet/hosts/:id/activities/upcoming/:activity_id`
|
||||
|
||||
#### Parameters
|
||||
|
||||
| Name | Type | In | Description |
|
||||
| ---- | ------- | ---- | ---------------------------- |
|
||||
| id | integer | path | **Required**. The host's ID. |
|
||||
| activity_id | string | path | **Required**. The ID of the host's upcoming activity. |
|
||||
|
||||
#### Example
|
||||
|
||||
`DELETE /api/v1/fleet/hosts/12/activities/upcoming/81e10a70-730b-4c45-9b40-b14373e04757`
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 204`
|
||||
|
||||
### Add labels to host
|
||||
|
||||
Adds manual labels to a host.
|
||||
@@ -6540,6 +6490,7 @@ This endpoint returns the list of custom MDM commands that have been executed.
|
||||
- [Get Apple Push Notification service (APNs)](#get-apple-push-notification-service-apns)
|
||||
- [List Apple Business Manager (ABM) tokens](#list-apple-business-manager-abm-tokens)
|
||||
- [List Volume Purchasing Program (VPP) tokens](#list-volume-purchasing-program-vpp-tokens)
|
||||
- [Get identity provider (IdP) details](#get-identity-provider-idp-details)
|
||||
- [Get Android Enterprise](#get-android-enterprise)
|
||||
|
||||
### Get Apple Push Notification service (APNs)
|
||||
@@ -6657,6 +6608,39 @@ None.
|
||||
]
|
||||
```
|
||||
|
||||
### Get identity provider (IdP) details
|
||||
|
||||
Get details about SCIM (System for Cross-domain Identity Management (SCIM)) integration with your identity provider (IdP).
|
||||
|
||||
`GET /api/v1/fleet/scim/details`
|
||||
|
||||
|
||||
#### Parameters
|
||||
|
||||
None.
|
||||
|
||||
|
||||
#### Example
|
||||
|
||||
`GET /api/v1/fleet/scim/details`
|
||||
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 200`
|
||||
|
||||
```json
|
||||
{
|
||||
"last_request": {
|
||||
"requested_at": "2025-03-11T02:02:17Z",
|
||||
"status": "success",
|
||||
"details": "",
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
### Get Android Enterprise
|
||||
|
||||
> **Experimental feature.** This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
|
||||
@@ -6665,6 +6649,7 @@ Get info about Android Enterprise that's connected to Fleet.
|
||||
|
||||
`GET /api/v1/fleet/android_enterprise`
|
||||
|
||||
|
||||
#### Parameters
|
||||
|
||||
None.
|
||||
@@ -6673,12 +6658,12 @@ None.
|
||||
|
||||
`GET /api/v1/fleet/android_enterprise`
|
||||
|
||||
|
||||
##### Default response
|
||||
|
||||
`Status: 200`
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"android_enterprise_id": "LC0445szuv"
|
||||
}
|
||||
@@ -6692,8 +6677,8 @@ None.
|
||||
- [List team policies](#list-team-policies)
|
||||
- [Count policies](#count-policies)
|
||||
- [Count team policies](#count-team-policies)
|
||||
- [Get policy](#get-policy)
|
||||
- [Get team policy](#get-team-policy)
|
||||
- [Get policy by ID](#get-policy-by-id)
|
||||
- [Get team policy by ID](#get-team-policy-by-id)
|
||||
- [Add policy](#add-policy)
|
||||
- [Add team policy](#add-team-policy)
|
||||
- [Delete policies](#delete-policies)
|
||||
@@ -6750,7 +6735,8 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th
|
||||
"updated_at": "2021-12-15T15:23:57Z",
|
||||
"passing_host_count": 2000,
|
||||
"failing_host_count": 300,
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z"
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z",
|
||||
"labels_include_any": ["Macs on Sonoma"]
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
@@ -6768,7 +6754,8 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th
|
||||
"updated_at": "2022-02-10T20:59:35Z",
|
||||
"passing_host_count": 2300,
|
||||
"failing_host_count": 0,
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z"
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z",
|
||||
"labels_exclude_any": ["Compliance exclusions", "Workstations (Canary)"]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -6821,7 +6808,8 @@ _Available in Fleet Premium_
|
||||
"passing_host_count": 2000,
|
||||
"failing_host_count": 300,
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z",
|
||||
"calendar_events_enabled": true
|
||||
"calendar_events_enabled": true,
|
||||
"labels_include_any": ["Macs on Sonoma"]
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
@@ -6841,6 +6829,7 @@ _Available in Fleet Premium_
|
||||
"failing_host_count": 0,
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z",
|
||||
"calendar_events_enabled": false,
|
||||
"labels_exclude_any": ["Compliance exclusions", "Workstations (Canary)"],
|
||||
"run_script": {
|
||||
"name": "Encrypt Windows disk with BitLocker",
|
||||
"id": 234
|
||||
@@ -6920,7 +6909,8 @@ _Available in Fleet Premium_
|
||||
"updated_at": "2021-12-16T16:39:00Z",
|
||||
"passing_host_count": 2000,
|
||||
"failing_host_count": 300,
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z"
|
||||
"host_count_updated_at": "2023-12-20T15:23:57Z",
|
||||
"labels_include_any": ["Macs on Sonoma"]
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
@@ -7019,7 +7009,7 @@ _Available in Fleet Premium_
|
||||
|
||||
---
|
||||
|
||||
### Get policy
|
||||
### Get policy by ID
|
||||
|
||||
`GET /api/v1/fleet/global/policies/:id`
|
||||
|
||||
@@ -7062,7 +7052,7 @@ _Available in Fleet Premium_
|
||||
|
||||
---
|
||||
|
||||
### Get team policy
|
||||
### Get team policy by ID
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
@@ -7103,6 +7093,7 @@ _Available in Fleet Premium_
|
||||
"failing_host_count": 0,
|
||||
"host_count_updated_at": null,
|
||||
"calendar_events_enabled": true,
|
||||
"labels_include_any": ["Macs on Sonoma"],
|
||||
"install_software": {
|
||||
"name": "Adobe Acrobat.app",
|
||||
"software_title_id": 1234
|
||||
@@ -7132,6 +7123,10 @@ _Available in Fleet Premium_
|
||||
| resolution | string | body | The resolution steps for the policy. |
|
||||
| platform | string | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. |
|
||||
| critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. |
|
||||
| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. |
|
||||
| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. |
|
||||
|
||||
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted.
|
||||
|
||||
#### Example (preferred)
|
||||
|
||||
@@ -7172,7 +7167,8 @@ _Available in Fleet Premium_
|
||||
"updated_at": "2022-03-17T20:15:55Z",
|
||||
"passing_host_count": 0,
|
||||
"failing_host_count": 0,
|
||||
"host_count_updated_at": null
|
||||
"host_count_updated_at": null,
|
||||
"labels_include_any": ["Macs on Sonoma"]
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -7202,9 +7198,13 @@ The semantics for creating a team policy are the same as for global policies, se
|
||||
| critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. |
|
||||
| software_title_id | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. If `software_title_id` is specified and the software has `labels_include_any` or `labels_exclude_any` defined, the policy will inherit this target in addition to specified `platform`. |
|
||||
| script_id | integer | body | _Available in Fleet Premium_. ID of script to run if the policy fails. |
|
||||
| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. |
|
||||
| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. |
|
||||
|
||||
Either `query` or `query_id` must be provided.
|
||||
|
||||
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted.
|
||||
|
||||
#### Example
|
||||
|
||||
`POST /api/v1/fleet/teams/1/policies`
|
||||
@@ -7246,6 +7246,7 @@ Either `query` or `query_id` must be provided.
|
||||
"failing_host_count": 0,
|
||||
"host_count_updated_at": null,
|
||||
"calendar_events_enabled": false,
|
||||
"labels_include_any": ["Macs on Sonoma"],
|
||||
"install_software": {
|
||||
"name": "Adobe Acrobat.app",
|
||||
"software_title_id": 1234
|
||||
@@ -7354,6 +7355,10 @@ _Available in Fleet Premium_
|
||||
| calendar_events_enabled | boolean | body | _Available in Fleet Premium_. Whether to trigger calendar events when policy is failing. |
|
||||
| software_title_id | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. Set to `null` to remove the automation. |
|
||||
| script_id | integer | body | _Available in Fleet Premium_. ID of script to run if the policy fails. Set to `null` to remove the automation. |
|
||||
| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. |
|
||||
| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. |
|
||||
|
||||
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted.
|
||||
|
||||
#### Example
|
||||
|
||||
@@ -7424,6 +7429,10 @@ _Available in Fleet Premium_
|
||||
| resolution | string | body | The resolution steps for the policy. |
|
||||
| platform | string | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. |
|
||||
| critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. |
|
||||
| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. |
|
||||
| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. |
|
||||
|
||||
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted.
|
||||
|
||||
#### Example
|
||||
|
||||
@@ -9639,7 +9648,8 @@ Add a package (.pkg, .msi, .exe, .deb, .rpm) to install on macOS, Windows, or Li
|
||||
| ---- | ------- | ---- | -------------------------------------------- |
|
||||
| software | file | form | **Required**. Installer package file. Supported packages are .pkg, .msi, .exe, .deb, and .rpm. |
|
||||
| team_id | integer | form | **Required**. The team ID. Adds a software package to the specified team. |
|
||||
| install_script | string | form | Script that Fleet runs to install software. If not specified Fleet runs [default install script](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
|
||||
| install_script | string | form | Script that Fleet runs to install software. If not specified Fleet runs the [default install script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) for each package type. |
|
||||
| uninstall_script | string | form | Script that Fleet runs to uninstall software. If not specified Fleet runs the [default uninstall script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) for each package type. |
|
||||
| pre_install_query | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. |
|
||||
| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
|
||||
| self_service | boolean | form | Self-service software is optional and can be installed by the end user. |
|
||||
@@ -9979,21 +9989,27 @@ List available Fleet-maintained apps.
|
||||
{
|
||||
"id": 1,
|
||||
"name": "1Password",
|
||||
"slug": "1password/darwin",
|
||||
"platform": "darwin",
|
||||
"software_title_id": 3
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"name": "1Password",
|
||||
"platform": "darwin",
|
||||
"version": "8.10.40",
|
||||
"software_title_id": 1
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"id": 2,
|
||||
"name": "Adobe Acrobat Reader",
|
||||
"slug": "adobe-acrobat-reader/darwin",
|
||||
"platform": "darwin",
|
||||
"version": "24.002.21005",
|
||||
"software_title_id": null
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"name": "Box Drive",
|
||||
"slug": "box-drive/darwin",
|
||||
"platform": "darwin",
|
||||
"version": "2.39.179",
|
||||
"software_title_id": 3
|
||||
},
|
||||
...
|
||||
],
|
||||
"meta": {
|
||||
@@ -11198,8 +11214,6 @@ _Available in Fleet Premium_
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
|
||||
### Add users to a team
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
@@ -216,7 +216,7 @@
|
||||
# ║ ╠╦╝║ ║╚═╗╚═╗───╠═╝║ ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║ ║║║ ║║║║║ ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║
|
||||
# ╚═╝╩╚═╚═╝╚═╝╚═╝ ╩ ╩═╝╩ ╩ ╩ ╚ ╚═╝╩╚═╩ ╩ ╩ ╩═╩╝╩ ╩ ╚═╝╚═╝╩ ╩ ╚═╝╩╚═ ╩
|
||||
- industryName: Cross-platform MDM support
|
||||
description: Apple, Windows, and Linux.
|
||||
description: Apple, Windows (x64 and Arm), Linux (amd64 and Arm), and Android (coming soon).
|
||||
documentationUrl: https://fleetdm.com/announcements/debunk-the-cross-platform-myth
|
||||
tier: Premium
|
||||
jamfProHasFeature: appleOnly
|
||||
@@ -326,6 +326,16 @@
|
||||
moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
|
||||
- description: See what servers someone is logged-in on
|
||||
moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on
|
||||
- industryName: Human-endpoint mapping (IdP groups)
|
||||
description: Add user information (e.g full name and groups) from your identity provider (e.g Okta) to your devices using the SCIM protocol.
|
||||
documentationUrl: https://fleetdm.com/guides/map-end-user-info-to-host-from-okta-idp
|
||||
pricingTableCategories: [Devices]
|
||||
productCategories: [Endpoint operations,Device management]
|
||||
tier: Premium
|
||||
jamfProHasFeature: no
|
||||
jamfProtectHasFeature: no
|
||||
waysToUse:
|
||||
- description: Add user information from your IdP to your devices via SCIM protocol.
|
||||
#
|
||||
# ╔╦╗╔═╗╦ ╦╦╔═╗╔═╗ ╦╔╗╔╦ ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
|
||||
# ║║║╣ ╚╗╔╝║║ ║╣ ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 170 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 169 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 143 KiB |
Vendored
+2
@@ -883,6 +883,8 @@ module.exports.routes = {
|
||||
'GET /learn-more-about/ui-gitops-mode': 'https://github.com/fleetdm/fleet-gitops/?tab=readme-ov-file#fleet-ui',
|
||||
'GET /learn-more-about/certificates-query': '/tables/certificates',
|
||||
'GET /learn-more-about/gitops': 'https://github.com/fleetdm/fleet-gitops/',
|
||||
'GET /learn-more-about/connect-idp': '/guides/add-user-info-from-idp-to-host',
|
||||
'GET /learn-more-about/troubleshoot-idp-connection': '/guides/add-user-info-from-idp-to-host#verify-connection-in-fleet',
|
||||
'GET /learn-more-about/unsigning-configuration-profiles': 'https://fleetdm.com/guides/custom-os-settings#enforce-os-settings',
|
||||
// FUTURE: update the temporary redirect below to go to the documentation for connecting Android enterprise
|
||||
'GET /learn-more-about/how-to-connect-android-enterprise': (req,res)=> { return res.redirect(302, '/contact');},
|
||||
|
||||
Vendored
+2
@@ -190,6 +190,8 @@
|
||||
</p>
|
||||
<p id="accordion__body7" class="collapse" aria-labelledby="accordion__header7">
|
||||
Fleet can see details about the user accounts associated with your device, including which accounts have logged in recently. This is useful for IT and security teams to identify logins from suspicious accounts.
|
||||
<br/>
|
||||
Fleet can also block logins from devices that don't meet your organization's policies. This allows IT teams to keep your accounts secure.
|
||||
</p>
|
||||
</div>
|
||||
<div purpose="accordion-item">
|
||||
|
||||
Reference in New Issue
Block a user