diff --git a/articles/enroll-hosts.md b/articles/enroll-hosts.md index 2a7f108dde..32ed087fbf 100644 --- a/articles/enroll-hosts.md +++ b/articles/enroll-hosts.md @@ -27,7 +27,9 @@ The `--type` flag is used to specify the fleetd installer type. A `--fleet-url` (Fleet instance URL) and `--enroll-secret` (Fleet enrollment secret) must be specified in order to communicate with Fleet instance. -To build an installer for ARM-based Linux, use the `--arch=arm64` flag with fleetctl. +To generate fleetd for an Arm Linux or Windows host, use the `--arch=arm64` flag. + +> **Fleetd for Arm Windows is an experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows. #### Example diff --git a/articles/fleet-4.65.0.md b/articles/fleet-4.65.0.md index 913a60ad73..7b66b80f61 100644 --- a/articles/fleet-4.65.0.md +++ b/articles/fleet-4.65.0.md @@ -1,9 +1,5 @@ # Fleet 4.65.0 | GitOps mode, automatically install software, certificates in host vitals -
- -
- Fleet 4.65.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.65.0) or continue reading to get the highlights. For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. diff --git a/articles/foreign-vitals-map-idp-users-to-hosts.md b/articles/foreign-vitals-map-idp-users-to-hosts.md new file mode 100644 index 0000000000..5caad62bbe --- /dev/null +++ b/articles/foreign-vitals-map-idp-users-to-hosts.md @@ -0,0 +1,80 @@ +# Foreign vitals: map IdP users to hosts + +![Import users from IdP to Fleet](../website/assets/images/articles/add-users-from-idp-cover-img.png) + +_Available in Fleet Premium._ + +To add IdP host vitals, like the end user's groups and full name, follow steps for your IdP. + +Fleet currently supports [Okta](#okta). [Microsoft Active Directory (AD) / Entra ID](#microsoft-entra-id), [Google Workspace](#google-workspace), and [authentik](#google-workspace), are coming soon. + + +## Okta + +To map users from Okta to hosts in Fleet, do the following steps: + +- [Create application in Okta](#step-1-create-application-in-okta) +- [Connect Okta to Fleet](#step-2-connect-okta-to-fleet) +- [Map users and groups to hosts in Fleet](#step-3-map-users-and-groups-to-hosts-in-fleet) + +#### Step 1: Create application in Okta + +1. Head to Okta admin dashboard. +2. In the main menu, select **Applications > Applications**, then select **Create App Integration**. +3. Select **SAML 2.0** option and select **Next**. +4. On the **General Settings** page, add a friendly **App name** (e.g Fleet SCIM), and select **Next**. +5. On the **SAML Settings** page, add any URL to the **Single sign-on URL** and **Audience URI (SP Entity ID)** fields, and select **Next**. +> Okta requires us to setup SAML settings in order to setup a SCIM integration. Since we don't need SAML right now, you can set the URL to anything like "example.fleetdm.com". +6. On the **Feedback** page, provide feedback if you want, and select **Finish**. +7. Select the **General** tab in your newly created app and then select **Edit** in **App Settings**. +8. For **Provisioning**, select **SCIM** and select **Save**. + +#### Step 2: Connect Okta to Fleet + +1. Select the **Provisioning** tab and then, in **SCIM Connection**, select **Edit**. +2. For the **SCIM connector base URL**, enter `https:///api/v1/fleet/scim`. +3. For the **Unique identifier field for users**, enter `userName`. +4. For the **Supported provisioning actions**, select **Push New Users**, **Push Profile Updates**, and **Push Groups**. +5. For the **Authentication Mode**, select **HTTP Header**. +6. Create a Fleet API-only user with maintainer permissions and copy API token for that user (learn how [here](https://fleetdm.com/guides/fleetctl#create-api-only-user)). Paste your API token in Okta's **Authorization** field. +7. Select the **Test Connector Configuration** button. You should see success message in Okta. +8. In Fleet, head to **Settings > Integrations > Identity provider (IdP)** and verify that Fleet successfully received the request from IdP. +9. Back in Okta, select **Save**. +10. Under the **Provisioning** tab, select **To App** and then select **Edit** in the **Provisioning to App** section. Enable **Create Users**, **Update User Attributes**, **Deactivate Users**, and then select **Save**. +11. On the same page, make sure that `givenName` and `familyName` have Okta value assigned to it. Currently, Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes. +![Okta SCIM attributes mapping](../website/assets/images/articles/okta-scim-attributes-mapping.png) + + +#### Step 3: Map users and groups to hosts in Fleet + +To send users and groups information to Fleet, you have to assign them to your new SCIM app. + +1. In OKta's main menu **Directory > Groups** and then select **Add group**. Name it "Fleet human-device mapping". +2. On the same page, select the **Rules** tab. Create a rule that will assign users to your "Fleet human-device mapping" group. +![Okta group rule](../website/assets/images/articles/okta-scim-group-rules.png) +3. In the main menu, select **Applications > Applications** and select your new SCIM app. Then, select the **Assignments** tab. +4. Select **Assign > Assign to Groups** and then select **Assign** next to the "Fleet human-device mapping" group. Then, select **Done**. Now all users that you assigned to the "Fleet human-device mapping" group will be provisioned to Fleet. +5. On the same page, select **Push Groups** tab. Then, select **Push Groups > Find groups by name** and add all groups that you assigned to "Fleet human-device mapping" group previously (make sure that **Push group memberships immediately** is selected). All groups will be provisioned in Fleet, and Fleet will map those groups to users. + +## Verify connection + +After following steps above, you should be able to see latest requests from your IdP to Fleet if you navigate to **Settings > Integrations > Identity Provider (IdP)**. + +To verify that user information is added to a host, go to the host that has IdP username assigned, and verify that **Full name (IdP)** and **Groups (IdP)** are populated correctly. + +### Troubleshooting + +If you find that information from IdP (e.g full name or groups) is missing on the host, and host has IdP username assigned to it, follow steps below to resolve. + +1. Please first go to Okta, select **Directory > People**, find user that is +missing information and make sure that it has all fields required by Fleet (username, first name, and +last name). +2. If all required fields are present, then go to **Applications > Applications > fleet_scim_application > Provisioning > To App**, then scroll on the bottom of the page and make sure that `userName`, `givenName`, and `familyName` has value assigned to it. +3. Otherwise make sure that all settings from instructions above were set correctly. + + + + + + + diff --git a/articles/role-based-access.md b/articles/role-based-access.md index eb587d16c3..3dae71041b 100644 --- a/articles/role-based-access.md +++ b/articles/role-based-access.md @@ -36,6 +36,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | **Action** | Observer | Observer+* | Maintainer | Admin | GitOps* | | ------------------------------------------------------------------------------------------------------------------------------------------ | :------: | :--------: | :--------: | :---: | :-----: | | View all [activity](https://fleetdm.com/docs/using-fleet/rest-api#activities) | ✅ | ✅ | ✅ | ✅ | | +| Cancel [hosts' upcoming activity](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) | | | ✅ | ✅ | | | Manage [activity automations](https://fleetdm.com/docs/using-fleet/audit-logs) | | | | ✅ | ✅ | | View all hosts | ✅ | ✅ | ✅ | ✅ | | | View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ | @@ -44,6 +45,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ | | Add and delete hosts | | | ✅ | ✅ | | | Transfer hosts between teams\* | | | ✅ | ✅ | ✅ | +| Add user information from IdP to hosts\* | | | ✅ | ✅ | | | Create, edit, and delete labels | | | ✅ | ✅ | ✅ | | View all software | ✅ | ✅ | ✅ | ✅ | | | Add, edit, and delete software | | | ✅ | ✅ | ✅ | @@ -129,6 +131,8 @@ Users with access to multiple teams can be assigned different roles for each tea | View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ | | Filter hosts using [labels](https://fleetdm.com/docs/using-fleet/rest-api#labels) | ✅ | ✅ | ✅ | ✅ | | | Target hosts using labels | ✅ | ✅ | ✅ | ✅ | | +| View hosts' [past](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity) and [upcoming](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) activity | ✅ | ✅ | ✅ | ✅ | | +| Cancel hosts' [upcoming](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity) activity | | | ✅ | ✅ | | | Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ | | Create and edit self-authored labels | | | | | ✅ | | Add and delete hosts | | | ✅ | ✅ | | diff --git a/articles/translating-jamf-pro-terminology.md b/articles/translating-jamf-pro-terminology.md index 30ad8f7d2a..560c9d314d 100644 --- a/articles/translating-jamf-pro-terminology.md +++ b/articles/translating-jamf-pro-terminology.md @@ -19,7 +19,7 @@ Whether you are using Fleet alongside Jamf Pro to manage your Apple devices or p | MDM enrolled | MDM enabled | MDM is a feature of Fleet. Hosts can be enrolled in Fleet without MDM enabled. You can get the benefits of Fleet while keeping your devices MDM enrolled with another solution. | | Configuration Profiles | Custom settings | Controls > OS settings > Custom settings | | Enrollment customization | Setup experience | Controls > Setup experience | -| Cloud identity providers | Single sign-on options | Settings > Single sign-on options | +| Cloud identity providers | Single sign-on (SSO) | Settings > Single sign-on (SSO) | | App installers | Fleet-maintained apps | | | Check-in Frequency | Agent options | | | App updates | Policy automation | | diff --git a/articles/what-are-fleet-policies.md b/articles/what-are-fleet-policies.md index fa5db900c2..8b543fb88b 100644 --- a/articles/what-are-fleet-policies.md +++ b/articles/what-are-fleet-policies.md @@ -18,6 +18,18 @@ To reduce the barrier of entry with Fleet, we’ve introduced our [standard temp 5. By default, policies are evaluated on an hourly interval, which is controlled by this [server setting](https://fleetdm.com/docs/configuration/fleet-server-configuration#osquery-policy-update-interval). Please see [this article](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies) for more information. +## Targeting hosts using platforms + +When creating or editing a policy, you can restrict the set of hosts it will run on by selecting one or more _platforms_ listed in the **Target** section. The policy will only be applied to hosts that run one of the selected platforms. For example, if only MacOS and Linux are selected, then the policy will not run on Windows or ChromeOS hosts. When you first create a policy, Fleet will attempt to automatically select all of the platforms that have the ability to run the related query. + +## Targeting hosts using labels + +_Available in Fleet Premium._ + +You can further restrict the set of hosts that a policy runs on by using [labels](https://fleetdm.com/guides/managing-labels-in-fleet). By default, a new policy will target all hosts of the selected platforms (see [Targeting hosts using platforms](https://fleetdm.com/docs/configuration/what-are-fleet-policies#targeting-hosts-using-labels) above), indicated by the **All Hosts** option being selected beneath the **Target** setting. If you select **Custom** instead, you will be able to select one or more labels for the policy to target. You can elect to have the policy run on hosts that match any of the selected labels by selecting "Include Any" from the provided dropdown. To instead _exclude_ hosts from running the policy if they match any of the selected labels, switch the dropdown to "Exclude any". + +To learn more about labels, see [Managing labels in Fleet](https://fleetdm.com/guides/managing-labels-in-fleet). + ## Identifying out-of-policy devices The policies page makes it easy to see which devices on each team are passing and failing with distinct “yes” or “no” responses. Although checking devices manually is relatively easy, we’ve made it even easier for endpoint detection and response security. We now have automation. diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 81a1bdb5c7..ca59f13354 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -2773,6 +2773,20 @@ The content of the Windows WSTEP identity key. An RSA private key, PEM-encoded. -----END RSA PRIVATE KEY----- ``` +## Partnerships + +### partnerships_enable_secureframe + +When enabled, end user's who select **Fleet Desktop > About Fleet** will be navigated to the fleetdm.com/better page with [Secureframe](https://secureframe.com/) branding. See the page here: https://fleetdm.com/better?utm_content=secureframe + +- Default value: `false` +- Environment variable: `FLEET_PARTNERSHIPS_ENABLE_SECUREFRAME` +- Config file format: + ``` + partnerships: + enable_secureframe: true + ``` +

Running with systemd

This content was moved to [Systemd](http://fleetdm.com/docs/deploy/system-d) on Sept 6th, 2023. diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index 44ef52d1c0..5f172792e1 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -101,6 +101,9 @@ policies: query: SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.'; platform: darwin critical: false + labels_include_any: + - Engineering + - Customer Support ``` #### Separate file @@ -658,6 +661,8 @@ In addition, you can configure your certificate authorities (CA) to help your en #### Example +`default.yml` + ```yaml org_settings: integrations: diff --git a/docs/Contributing/API-for-contributors.md b/docs/Contributing/API-for-contributors.md index ab600db268..692d6fc34a 100644 --- a/docs/Contributing/API-for-contributors.md +++ b/docs/Contributing/API-for-contributors.md @@ -4535,6 +4535,9 @@ Content-Disposition: attachment Content-Length: Body: ``` + +--- + ## Users ### Update user-specific UI settings diff --git a/docs/Contributing/Audit-logs.md b/docs/Contributing/Audit-logs.md index dc2e5f83ba..5e9b8ebb00 100644 --- a/docs/Contributing/Audit-logs.md +++ b/docs/Contributing/Audit-logs.md @@ -1706,6 +1706,7 @@ This activity contains the following fields: Generated when upcoming activity `installed_software` is canceled. + This activity contains the following fields: - "host_id": ID of the host. - "host_display_name": Display name of the host. @@ -1716,10 +1717,10 @@ This activity contains the following fields: ```json { - "host_id": 1, - "host_display_name": "Anna's MacBook Pro", - "software_title": "Adobe Acrobat.app", - "software_title_id": 12334 + "host_id": 123, + "host_display_name": "Marko's MacBook Pro", + "software_title": "Adobe Acrobat.app", + "software_title_id": 12334 } ``` @@ -1737,16 +1738,16 @@ This activity contains the following fields: ```json { - "host_id": 1, - "host_display_name": "Anna's MacBook Pro", - "software_title": "Adobe Acrobat.app", - "software_title_id": 12334 + "host_id": 123, + "host_display_name": "Marko's MacBook Pro", + "software_title": "Adobe Acrobat.app", + "software_title_id": 12334 } ``` ## canceled_install_app_store_app -Generated when upcoming activity `installed_app_store_app` is canceled. +Generated when upcoming activity `installed_app_store_app` is canceled. This activity contains the following fields: - "host_id": ID of the host. @@ -1758,14 +1759,13 @@ This activity contains the following fields: ```json { - "host_id": 123, - "host_display_name": "Anna's MacBook Pro", - "software_title": "Adobe Acrobat.app", - "software_title_id": 12334 + "host_id": 123, + "host_display_name": "Anna's MacBook Pro", + "software_title": "Adobe Acrobat.app", + "software_title_id": 12334 } ``` - diff --git a/docs/Contributing/Testing-and-local-development.md b/docs/Contributing/Testing-and-local-development.md index 3792ac3813..09f25aa44e 100644 --- a/docs/Contributing/Testing-and-local-development.md +++ b/docs/Contributing/Testing-and-local-development.md @@ -342,7 +342,7 @@ Fleet's `docker-compose` file includes a SAML identity provider (IdP) for testin ### Configuration -Configure SSO on the Organization Settings page with the following: +Configure SSO on the **Integration settings** page with the following: ``` Identity Provider Name: SimpleSAML diff --git a/docs/Deploy/single-sign-on-sso.md b/docs/Deploy/single-sign-on-sso.md index 9e5f09ddbf..4cebd1c41c 100644 --- a/docs/Deploy/single-sign-on-sso.md +++ b/docs/Deploy/single-sign-on-sso.md @@ -139,7 +139,7 @@ After supplying the above information, your IdP will generate an issuer URI and ## Fleet configuration -To configure SSO in Fleet head to **Settings > Organization settings > Single sign-on options**. +To configure SSO in Fleet head to **Settings > Integrations > Single sign-on (SSO)**. If you're configuring end user authentication head to **Settings > Integrations > Automatic enrollment > End user authentication**. @@ -165,7 +165,7 @@ The new account's email and full name are copied from the user data in the SSO r By default, accounts created via JIT provisioning are assigned the [Global Observer role](https://fleetdm.com/docs/using-fleet/permissions). To assign different roles for accounts created via JIT provisioning see [Customization of user roles](#customization-of-user-roles) below. -To enable this option, go to **Settings > Organization settings > Single sign-on options** and check "_Create user and sync permissions on login_" or [adjust your config](#sso-settings-enable-jit-provisioning). +To enable this option, go to **Settings > Integrations > Single sign-on (SSO)** and check "_Create user and sync permissions on login_" or [adjust your config](#sso-settings-enable-jit-provisioning). For this to work correctly make sure that: diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 56b70568fb..b3241c1287 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -2257,6 +2257,7 @@ None. - [Wipe host](#wipe-host) - [Get host's past activity](#get-hosts-past-activity) - [Get host's upcoming activity](#get-hosts-upcoming-activity) +- [Cancel host's upcoming activity](#cancel-hosts-upcoming-activity) - [Add labels to host](#add-labels-to-host) - [Remove labels from host](#remove-labels-from-host) - [Live query one host (ad-hoc)](#live-query-one-host-ad-hoc) @@ -2895,6 +2896,28 @@ Returns the information of the specified host. "shell": "/bin/zsh" } ], + "end_users": [ + { + "idp_info_updated_at": "2025-03-20T02:02:17Z", + "idp_id": "f26f8649-1e25-42c5-be71-1b1e6de56d3d", + "idp_username": "anna@acme.com", + "idp_full_name": "Anna Chao", + "idp_groups": [ + "Product", + "Designers" + ], + "other_emails": [ + { + "email": "anna@example.com", + "source": "google_chrome_profiles" + }, + { + "email": "anna@example.com", + "source": "custom" + } + ] + } + ], "labels": [ { "created_at": "2021-08-19T02:02:17Z", @@ -3026,6 +3049,8 @@ Returns the information of the specified host. > - `fleet_desktop_version: ""` means this agent is a fleetd agent but does not have fleet desktop > - `scripts_enabled: null` means this agent is not a fleetd agent, or this agent is version <=1.23.0 which is not collecting the scripts enabled info +> Note: [Get human-device mapping](https://github.com/fleetdm/fleet/blob/62dc32454f6a40e81fe229abdfc370d3bf7a56c6/docs/REST%20API/rest-api.md?plain=1#L3518) and [Update custom human-device mapping endpoints](https://github.com/fleetdm/fleet/blob/62dc32454f6a40e81fe229abdfc370d3bf7a56c6/docs/REST%20API/rest-api.md?plain=1#L3564) are deprecated. End user information is available as part of the [Get host](#get-host) endpoint. + ### Get host by identifier Returns the information of the host specified using the `hostname`, `uuid`, or `hardware_serial` as an identifier. @@ -3635,100 +3660,6 @@ Request (`filters` is specified and empty, to delete all hosts): `Status: 200` -### Get human-device mapping - -Returns the end user's email(s) they use to log in to their Identity Provider (IdP) and Google Chrome profile. - -Also returns the custom email that's set via the `PUT /api/v1/fleet/hosts/:id/device_mapping` endpoint (docs [here](#update-custom-human-device-mapping)) - -Note that IdP email is only supported on macOS hosts. It's collected once, during automatic enrollment (DEP), only if the end user authenticates with the IdP and the DEP profile has `await_device_configured` set to `true`. - -`GET /api/v1/fleet/hosts/:id/device_mapping` - -#### Parameters - -| Name | Type | In | Description | -| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- | -| id | integer | path | **Required**. The host's `id`. | - -#### Example - -`GET /api/v1/fleet/hosts/1/device_mapping` - -##### Default response - -`Status: 200` - -```json -{ - "host_id": 1, - "device_mapping": [ - { - "email": "user@example.com", - "source": "mdm_idp_accounts" - }, - { - "email": "user@example.com", - "source": "google_chrome_profiles" - }, - { - "email": "user@example.com", - "source": "custom" - } - ] -} -``` - ---- - -### Update custom human-device mapping - -`PUT /api/v1/fleet/hosts/:id/device_mapping` - -Updates the email for the `custom` data source in the human-device mapping. This source can only have one email. - -#### Parameters - -| Name | Type | In | Description | -| ---------- | ----------------- | ---- | ----------------------------------------------------------------------------- | -| id | integer | path | **Required**. The host's `id`. | -| email | string | body | **Required**. The custom email. | - -#### Example - -`PUT /api/v1/fleet/hosts/1/device_mapping` - -##### Request body - -```json -{ - "email": "user@example.com" -} -``` - -##### Default response - -`Status: 200` - -```json -{ - "host_id": 1, - "device_mapping": [ - { - "email": "user@example.com", - "source": "mdm_idp_accounts" - }, - { - "email": "user@example.com", - "source": "google_chrome_profiles" - }, - { - "email": "user@example.com", - "source": "custom" - } - ] -} -``` ### Get host's device health report @@ -4632,6 +4563,25 @@ To wipe a macOS, iOS, iPadOS, or Windows host, the host must have MDM turned on. } ``` +### Cancel host's upcoming activity + +`DELETE /api/v1/fleet/hosts/:id/activities/upcoming/:activity_id` + +#### Parameters + +| Name | Type | In | Description | +| ---- | ------- | ---- | ---------------------------- | +| id | integer | path | **Required**. The host's ID. | +| activity_id | string | path | **Required**. The ID of the host's upcoming activity. | + +#### Example + +`DELETE /api/v1/fleet/hosts/12/activities/upcoming/81e10a70-730b-4c45-9b40-b14373e04757` + +##### Default response + +`Status: 204` + ### Add labels to host Adds manual labels to a host. @@ -6540,6 +6490,7 @@ This endpoint returns the list of custom MDM commands that have been executed. - [Get Apple Push Notification service (APNs)](#get-apple-push-notification-service-apns) - [List Apple Business Manager (ABM) tokens](#list-apple-business-manager-abm-tokens) - [List Volume Purchasing Program (VPP) tokens](#list-volume-purchasing-program-vpp-tokens) +- [Get identity provider (IdP) details](#get-identity-provider-idp-details) - [Get Android Enterprise](#get-android-enterprise) ### Get Apple Push Notification service (APNs) @@ -6657,6 +6608,39 @@ None. ] ``` +### Get identity provider (IdP) details + +Get details about SCIM (System for Cross-domain Identity Management (SCIM)) integration with your identity provider (IdP). + +`GET /api/v1/fleet/scim/details` + + +#### Parameters + +None. + + +#### Example + +`GET /api/v1/fleet/scim/details` + + +##### Default response + +`Status: 200` + +```json +{ + "last_request": { + "requested_at": "2025-03-11T02:02:17Z", + "status": "success", + "details": "", + } +} +``` + + + ### Get Android Enterprise > **Experimental feature.** This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows. @@ -6665,6 +6649,7 @@ Get info about Android Enterprise that's connected to Fleet. `GET /api/v1/fleet/android_enterprise` + #### Parameters None. @@ -6673,12 +6658,12 @@ None. `GET /api/v1/fleet/android_enterprise` + ##### Default response `Status: 200` ```json - { "android_enterprise_id": "LC0445szuv" } @@ -6692,8 +6677,8 @@ None. - [List team policies](#list-team-policies) - [Count policies](#count-policies) - [Count team policies](#count-team-policies) -- [Get policy](#get-policy) -- [Get team policy](#get-team-policy) +- [Get policy by ID](#get-policy-by-id) +- [Get team policy by ID](#get-team-policy-by-id) - [Add policy](#add-policy) - [Add team policy](#add-team-policy) - [Delete policies](#delete-policies) @@ -6750,7 +6735,8 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th "updated_at": "2021-12-15T15:23:57Z", "passing_host_count": 2000, "failing_host_count": 300, - "host_count_updated_at": "2023-12-20T15:23:57Z" + "host_count_updated_at": "2023-12-20T15:23:57Z", + "labels_include_any": ["Macs on Sonoma"] }, { "id": 2, @@ -6768,7 +6754,8 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th "updated_at": "2022-02-10T20:59:35Z", "passing_host_count": 2300, "failing_host_count": 0, - "host_count_updated_at": "2023-12-20T15:23:57Z" + "host_count_updated_at": "2023-12-20T15:23:57Z", + "labels_exclude_any": ["Compliance exclusions", "Workstations (Canary)"] } ] } @@ -6821,7 +6808,8 @@ _Available in Fleet Premium_ "passing_host_count": 2000, "failing_host_count": 300, "host_count_updated_at": "2023-12-20T15:23:57Z", - "calendar_events_enabled": true + "calendar_events_enabled": true, + "labels_include_any": ["Macs on Sonoma"] }, { "id": 2, @@ -6841,6 +6829,7 @@ _Available in Fleet Premium_ "failing_host_count": 0, "host_count_updated_at": "2023-12-20T15:23:57Z", "calendar_events_enabled": false, + "labels_exclude_any": ["Compliance exclusions", "Workstations (Canary)"], "run_script": { "name": "Encrypt Windows disk with BitLocker", "id": 234 @@ -6920,7 +6909,8 @@ _Available in Fleet Premium_ "updated_at": "2021-12-16T16:39:00Z", "passing_host_count": 2000, "failing_host_count": 300, - "host_count_updated_at": "2023-12-20T15:23:57Z" + "host_count_updated_at": "2023-12-20T15:23:57Z", + "labels_include_any": ["Macs on Sonoma"] }, { "id": 2, @@ -7019,7 +7009,7 @@ _Available in Fleet Premium_ --- -### Get policy +### Get policy by ID `GET /api/v1/fleet/global/policies/:id` @@ -7062,7 +7052,7 @@ _Available in Fleet Premium_ --- -### Get team policy +### Get team policy by ID _Available in Fleet Premium_ @@ -7103,6 +7093,7 @@ _Available in Fleet Premium_ "failing_host_count": 0, "host_count_updated_at": null, "calendar_events_enabled": true, + "labels_include_any": ["Macs on Sonoma"], "install_software": { "name": "Adobe Acrobat.app", "software_title_id": 1234 @@ -7132,6 +7123,10 @@ _Available in Fleet Premium_ | resolution | string | body | The resolution steps for the policy. | | platform | string | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. | | critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. | +| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. | +| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. | + +Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted. #### Example (preferred) @@ -7172,7 +7167,8 @@ _Available in Fleet Premium_ "updated_at": "2022-03-17T20:15:55Z", "passing_host_count": 0, "failing_host_count": 0, - "host_count_updated_at": null + "host_count_updated_at": null, + "labels_include_any": ["Macs on Sonoma"] } } ``` @@ -7202,9 +7198,13 @@ The semantics for creating a team policy are the same as for global policies, se | critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. | | software_title_id | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. If `software_title_id` is specified and the software has `labels_include_any` or `labels_exclude_any` defined, the policy will inherit this target in addition to specified `platform`. | | script_id | integer | body | _Available in Fleet Premium_. ID of script to run if the policy fails. | +| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. | +| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. | Either `query` or `query_id` must be provided. +Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted. + #### Example `POST /api/v1/fleet/teams/1/policies` @@ -7246,6 +7246,7 @@ Either `query` or `query_id` must be provided. "failing_host_count": 0, "host_count_updated_at": null, "calendar_events_enabled": false, + "labels_include_any": ["Macs on Sonoma"], "install_software": { "name": "Adobe Acrobat.app", "software_title_id": 1234 @@ -7354,6 +7355,10 @@ _Available in Fleet Premium_ | calendar_events_enabled | boolean | body | _Available in Fleet Premium_. Whether to trigger calendar events when policy is failing. | | software_title_id | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. Set to `null` to remove the automation. | | script_id | integer | body | _Available in Fleet Premium_. ID of script to run if the policy fails. Set to `null` to remove the automation. | +| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. | +| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. | + +Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted. #### Example @@ -7424,6 +7429,10 @@ _Available in Fleet Premium_ | resolution | string | body | The resolution steps for the policy. | | platform | string | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. | | critical | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. | +| labels_include_any | array | form | _Available in Fleet Premium_. Target hosts that have any label in the array. | +| labels_exclude_any | array | form | _Available in Fleet Premium_. Target hosts that that don’t have any label in the array. | + +Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither is set, all hosts on the specified `platform` are targeted. #### Example @@ -9639,7 +9648,8 @@ Add a package (.pkg, .msi, .exe, .deb, .rpm) to install on macOS, Windows, or Li | ---- | ------- | ---- | -------------------------------------------- | | software | file | form | **Required**. Installer package file. Supported packages are .pkg, .msi, .exe, .deb, and .rpm. | | team_id | integer | form | **Required**. The team ID. Adds a software package to the specified team. | -| install_script | string | form | Script that Fleet runs to install software. If not specified Fleet runs [default install script](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. | +| install_script | string | form | Script that Fleet runs to install software. If not specified Fleet runs the [default install script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) for each package type. | +| uninstall_script | string | form | Script that Fleet runs to uninstall software. If not specified Fleet runs the [default uninstall script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) for each package type. | | pre_install_query | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. | | post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. | | self_service | boolean | form | Self-service software is optional and can be installed by the end user. | @@ -9979,21 +9989,27 @@ List available Fleet-maintained apps. { "id": 1, "name": "1Password", + "slug": "1password/darwin", "platform": "darwin", - "software_title_id": 3 - }, - { - "id": 2, - "name": "1Password", - "platform": "darwin", + "version": "8.10.40", "software_title_id": 1 }, { - "id": 3, + "id": 2, "name": "Adobe Acrobat Reader", + "slug": "adobe-acrobat-reader/darwin", "platform": "darwin", + "version": "24.002.21005", "software_title_id": null }, + { + "id": 3, + "name": "Box Drive", + "slug": "box-drive/darwin", + "platform": "darwin", + "version": "2.39.179", + "software_title_id": 3 + }, ... ], "meta": { @@ -11198,8 +11214,6 @@ _Available in Fleet Premium_ } ``` - - ### Add users to a team _Available in Fleet Premium_ diff --git a/handbook/company/pricing-features-table.yml b/handbook/company/pricing-features-table.yml index 17aa7c41b0..a3d4294e7a 100644 --- a/handbook/company/pricing-features-table.yml +++ b/handbook/company/pricing-features-table.yml @@ -216,7 +216,7 @@ # ║ ╠╦╝║ ║╚═╗╚═╗───╠═╝║ ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║ ║║║ ║║║║║ ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║ # ╚═╝╩╚═╚═╝╚═╝╚═╝ ╩ ╩═╝╩ ╩ ╩ ╚ ╚═╝╩╚═╩ ╩ ╩ ╩═╩╝╩ ╩ ╚═╝╚═╝╩ ╩ ╚═╝╩╚═ ╩ - industryName: Cross-platform MDM support - description: Apple, Windows, and Linux. + description: Apple, Windows (x64 and Arm), Linux (amd64 and Arm), and Android (coming soon). documentationUrl: https://fleetdm.com/announcements/debunk-the-cross-platform-myth tier: Premium jamfProHasFeature: appleOnly @@ -326,6 +326,16 @@ moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit - description: See what servers someone is logged-in on moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on +- industryName: Human-endpoint mapping (IdP groups) + description: Add user information (e.g full name and groups) from your identity provider (e.g Okta) to your devices using the SCIM protocol. + documentationUrl: https://fleetdm.com/guides/map-end-user-info-to-host-from-okta-idp + pricingTableCategories: [Devices] + productCategories: [Endpoint operations,Device management] + tier: Premium + jamfProHasFeature: no + jamfProtectHasFeature: no + waysToUse: + - description: Add user information from your IdP to your devices via SCIM protocol. # # ╔╦╗╔═╗╦ ╦╦╔═╗╔═╗ ╦╔╗╔╦ ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦ # ║║║╣ ╚╗╔╝║║ ║╣ ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝ diff --git a/website/assets/images/articles/add-users-from-idp-cover-img.png b/website/assets/images/articles/add-users-from-idp-cover-img.png new file mode 100644 index 0000000000..b71605cea3 Binary files /dev/null and b/website/assets/images/articles/add-users-from-idp-cover-img.png differ diff --git a/website/assets/images/articles/authentik-group-ldap-attributes-custom-mappings.png b/website/assets/images/articles/authentik-group-ldap-attributes-custom-mappings.png new file mode 100644 index 0000000000..98b759011e Binary files /dev/null and b/website/assets/images/articles/authentik-group-ldap-attributes-custom-mappings.png differ diff --git a/website/assets/images/articles/authentik-user-ldap-attributes-custom-mappings.png b/website/assets/images/articles/authentik-user-ldap-attributes-custom-mappings.png new file mode 100644 index 0000000000..b70245b936 Binary files /dev/null and b/website/assets/images/articles/authentik-user-ldap-attributes-custom-mappings.png differ diff --git a/website/assets/images/articles/entra-group-scim-attributes.png b/website/assets/images/articles/entra-group-scim-attributes.png new file mode 100644 index 0000000000..a04267fc29 Binary files /dev/null and b/website/assets/images/articles/entra-group-scim-attributes.png differ diff --git a/website/assets/images/articles/entra-user-scim-attributes.png b/website/assets/images/articles/entra-user-scim-attributes.png new file mode 100644 index 0000000000..2b38d1436b Binary files /dev/null and b/website/assets/images/articles/entra-user-scim-attributes.png differ diff --git a/website/assets/images/articles/okta-scim-attributes-mapping.png b/website/assets/images/articles/okta-scim-attributes-mapping.png new file mode 100644 index 0000000000..ba8b9a509b Binary files /dev/null and b/website/assets/images/articles/okta-scim-attributes-mapping.png differ diff --git a/website/assets/images/articles/okta-scim-group-rules.png b/website/assets/images/articles/okta-scim-group-rules.png new file mode 100644 index 0000000000..e54816b9cf Binary files /dev/null and b/website/assets/images/articles/okta-scim-group-rules.png differ diff --git a/website/config/routes.js b/website/config/routes.js index ca179e0594..289489554a 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -883,6 +883,8 @@ module.exports.routes = { 'GET /learn-more-about/ui-gitops-mode': 'https://github.com/fleetdm/fleet-gitops/?tab=readme-ov-file#fleet-ui', 'GET /learn-more-about/certificates-query': '/tables/certificates', 'GET /learn-more-about/gitops': 'https://github.com/fleetdm/fleet-gitops/', + 'GET /learn-more-about/connect-idp': '/guides/add-user-info-from-idp-to-host', + 'GET /learn-more-about/troubleshoot-idp-connection': '/guides/add-user-info-from-idp-to-host#verify-connection-in-fleet', 'GET /learn-more-about/unsigning-configuration-profiles': 'https://fleetdm.com/guides/custom-os-settings#enforce-os-settings', // FUTURE: update the temporary redirect below to go to the documentation for connecting Android enterprise 'GET /learn-more-about/how-to-connect-android-enterprise': (req,res)=> { return res.redirect(302, '/contact');}, diff --git a/website/views/pages/transparency.ejs b/website/views/pages/transparency.ejs index dda7c8b5d5..a024ad9966 100644 --- a/website/views/pages/transparency.ejs +++ b/website/views/pages/transparency.ejs @@ -190,6 +190,8 @@

Fleet can see details about the user accounts associated with your device, including which accounts have logged in recently. This is useful for IT and security teams to identify logins from suspicious accounts. +
+ Fleet can also block logins from devices that don't meet your organization's policies. This allows IT teams to keep your accounts secure.