diff --git a/docs/Using Fleet/Audit-logs.md b/docs/Using Fleet/Audit-logs.md
index ec61226f81..4654c37421 100644
--- a/docs/Using Fleet/Audit-logs.md
+++ b/docs/Using Fleet/Audit-logs.md
@@ -1,7 +1,7 @@
# Audit logs
-Fleet logs the following information for administrative actions (in JSON):
+Fleet logs the following information for administrative activities (in JSON):
- `created_at`: Timestamp of the event.
- `id`: Unique ID of the generated event in Fleet.
@@ -28,8 +28,12 @@ Example:
}
}
```
+
+You can automatically send these logs to your log destination. Learn how to configure this [here](https://fleetdm.com/docs/configuration/fleet-server-configuration#external-activity-audit-logging).
+
+To view activities in the UI, click the Fleet icon in the top navigation bar and locate the **Activity** section.
-## List of activities and their specific details
+## Activity types
### Type `created_pack`
diff --git a/docs/Using Fleet/MDM-commands.md b/docs/Using Fleet/MDM-commands.md
index 4758e2d696..5483d79a59 100644
--- a/docs/Using Fleet/MDM-commands.md
+++ b/docs/Using Fleet/MDM-commands.md
@@ -60,7 +60,7 @@ Fleet UI:
### Step 3: run the command
-1. Run the `fleetctl mdm run-command --payload=restart-device.xml --host=hostname `
+1. Run the `fleetctl mdm run-command --payload=restart-device.xml --host=hostname ` command.
> Replace the --payload and --host flags with your `.xml` file and hostname respectively.
2. Look at the on-screen information. In the output you'll see the command required to see results. Be sure to copy this command. If you don't, it will be difficult to view command results later.
diff --git a/docs/Using Fleet/Scripts.md b/docs/Using Fleet/Scripts.md
new file mode 100644
index 0000000000..bbc8b517bf
--- /dev/null
+++ b/docs/Using Fleet/Scripts.md
@@ -0,0 +1,67 @@
+# Scripts
+
+_Available in Fleet Premium_
+
+In Fleet you can execute a custom script to remediate an issue on your macOS, Windows, and Linux hosts.
+
+Shell scripts are supported on macOS and Linux. All scripts will run in the host's (root) default shell (`/bin/sh`). Other interpreters are not supported yet.
+
+PowerShell scripts are supported on Windows. Other types of scripts are not supported yet.
+
+Script execution is disabled by default. Continue reading to learn how to enable scripts.
+
+## Execute a script
+
+You can execute a script using the `fleetctl` command-line interface.
+
+To execute a script, we will do the following steps:
+1. Enable script execution
+2. Write a script
+3. Run the script
+
+### Step 1: Enable script execution
+
+If you use Fleet's macOS MDM features, scripts are automatically enabled for macOS hosts that have MDM turned on. You're set!
+
+If you don't use MDM features, to enable scripts, we'll deploy a fleetd agent with scripts enabled:
+
+1. Generate a new fleetd agent for macOS, Windows, or Linux using the `fleetctl package` command with the `--enable-scripts` flag.
+
+2. Deploy fleetd to your hosts. If your hosts already have fleetd installed, you can deploy the new fleetd on-top of the old installation.
+
+Learn more about generating a fleetd agent and deploying it [here](./enroll-hosts.md#enroll-hosts-with-fleetd).
+
+### Step 2: Write a script
+
+As an example, we'll write a shell script for a macOS host that downloads a Fleet wallpaper and set the host's wallpaper to it.
+
+To run the script, we'll need to create a `set-wallpaper-to-fleet.sh` file locally and copy and paste this script into this `.sh` file:
+
+```sh
+wallpaper="/tmp/wallpaper.png"
+
+curl --fail https://fleetdm.com/images/wallpaper-cloud-city-1920x1080.png -o $wallpaper
+
+osascript -e 'tell application "Finder" to set desktop picture to POSIX file "'"$wallpaper"'"'
+```
+
+### Step 3: Run the script
+
+1. Run the `fleetctl run-script --script_path=set-wallpaper-to-fleet.sh --host=hostname` command.
+
+> Replace --host flag with your target host's hostname respectively.
+
+2. Look at the on-screen information. In the output you'll see the script's exit code and output.
+
+Each time a Fleet user runs a script an entry is created in [Fleet's activity feed](./Audit-logs.md#type-code-ran-script-code).
+
+## Security considerations
+
+Script execution can only be enabled by someone with root access to the host.
+
+Turning MDM on for a macOS host or pushing a new fleetd agent qualify as root access.
+
+
+
+
+
diff --git a/server/fleet/gen_activity_doc.go b/server/fleet/gen_activity_doc.go
index 86155e1e39..477ba82ce1 100644
--- a/server/fleet/gen_activity_doc.go
+++ b/server/fleet/gen_activity_doc.go
@@ -17,7 +17,7 @@ func main() {
b.WriteString(`
# Audit logs
-Fleet logs the following information for administrative actions (in JSON):
+Fleet logs the following information for administrative activities (in JSON):
- ` + "`" + `created_at` + "`" + `: Timestamp of the event.
- ` + "`" + `id` + "`" + `: Unique ID of the generated event in Fleet.
@@ -44,8 +44,12 @@ Example:
}
}
` + "```" + `
+
+You can automatically send these logs to your log destination. Learn how to configure this [here](https://fleetdm.com/docs/configuration/fleet-server-configuration#external-activity-audit-logging).
+
+To view activities in the UI, click the Fleet icon in the top navigation bar and locate the **Activity** section.
-## List of activities and their specific details
+## Activity types
`)
@@ -64,6 +68,7 @@ Example:
}
}
b.WriteString(`
+
diff --git a/website/assets/images/wallpaper-cloud-city-1920x1080.png b/website/assets/images/wallpaper-cloud-city-1920x1080.png
new file mode 100644
index 0000000000..ca6af371ff
Binary files /dev/null and b/website/assets/images/wallpaper-cloud-city-1920x1080.png differ