diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml new file mode 100644 index 0000000000..14c23204cc --- /dev/null +++ b/.github/workflows/dogfood-gitops.yml @@ -0,0 +1,61 @@ +name: 'Apply latest configuration to dogfood with gitops' + +on: + push: + branches: + - main + paths: + - 'it-and-security/**' + - '.github/workflows/dogfood-gitops.yml' + workflow_dispatch: # allows manual triggering + +defaults: + run: + shell: bash + +# Limit permissions of GITHUB_TOKEN. +permissions: + contents: read + +jobs: + fleet-gitops: + timeout-minutes: 10 + runs-on: ubuntu-latest + steps: + - name: Checkout our repository + uses: actions/checkout@v4 + + - name: Checkout GitOps repository + uses: actions/checkout@v4 + with: + repository: fleetdm/fleet-gitops + ref: main + path: fleet-gitops + + - name: Apply env vars to profiles + env: + MANAGED_CHROME_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }} + run: | + envsubst < ./it-and-security/lib/configuration-profiles/macos-chrome-enrollment.mobileconfig > ./it-and-security/lib/configuration-profiles/macos-chrome-enrollment.confidential.mobileconfig + mv ./it-and-security/lib/configuration-profiles/macos-chrome-enrollment.confidential.mobileconfig ./it-and-security/lib/configuration-profiles/macos-chrome-enrollment.mobileconfig + + - name: Apply latest configuration to Fleet + uses: ./fleet-gitops/.github/gitops-action + with: + working-directory: ${{ github.workspace }}/fleet-gitops + env: + FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security + FLEET_URL: https://dogfood.fleetdm.com + FLEET_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }} + DOGFOOD_APPLE_BM_DEFAULT_TEAM: Workstations + DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL: ${{ secrets.DOGFOOD_MACOS_MIGRATION_WEBHOOK_URL }} + DOGFOOD_GLOBAL_ENROLL_SECRET: ${{ secrets.DOGFOOD_GLOBAL_ENROLL_SECRET }} + DOGFOOD_SSO_ISSUER_URI: ${{ secrets.DOGFOOD_SSO_ISSUER_URI }} + DOGFOOD_SSO_METADATA: ${{ secrets.DOGFOOD_SSO_METADATA }} + DOGFOOD_FAILING_POLICIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_FAILING_POLICIES_WEBHOOK_URL }} + DOGFOOD_VULNERABILITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_VULNERABILITIES_WEBHOOK_URL }} + DOGFOOD_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_ENROLL_SECRET }} + DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET }} + DOGFOOD_SERVERS_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_ENROLL_SECRET }} + DOGFOOD_SERVERS_CANARY_ENROLL_SECRET: ${{ secrets.DOGFOOD_SERVERS_CANARY_ENROLL_SECRET }} + DOGFOOD_EXPLORE_DATA_ENROLL_SECRET: ${{ secrets.DOGFOOD_EXPLORE_DATA_ENROLL_SECRET }} diff --git a/.github/workflows/example-workflow.yaml b/.github/workflows/example-workflow.yaml deleted file mode 100644 index 5a19e87b9f..0000000000 --- a/.github/workflows/example-workflow.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# This workflow applies the latest configuration profiles (macOS settings) and macOS updates minimum version and deadline to the provided team. -name: Apply latest configuration profiles (example) -on: - push: - branches: - - main - paths: - - "path/to/**.mobileconfig" - workflow_dispatch: # Manual - -# This allows a subsequently queued workflow run to interrupt previous runs -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} - cancel-in-progress: true - -defaults: - run: - # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference - shell: bash - -permissions: - contents: read - -env: - FLEET_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }} - FLEET_URL: ${{ secrets.DOGFOOD_URL }} - TOKEN_USED_BY_PROFILE: ${{ secrets.TOKEN_USED_BY_PROFILE }} - -jobs: - apply-profiles: - timeout-minutes: 5 - runs-on: ubuntu-latest - steps: - - name: Apply configuration profiles and updates - uses: fleetdm/fleet-mdm-gitops@15072f2739ef92c6357414ddd86e89b6bf302a2b - with: - FLEET_API_TOKEN: $FLEET_API_TOKEN - FLEET_URL: $FLEET_URL - FLEET_TEAM_NAME: š»š£ Workstations (canary) - MDM_CONFIG_REPO: fleetdm/fleet - MDM_CONFIG_DIRECTORY: mdm_profiles - MAC_OS_MIN_VERSION: 13.3.2 - MAC_OS_VERSION_DEADLINE: 2023-06-15 - MAC_OS_ENABLE_DISK_ENCRYPTION: true diff --git a/.github/workflows/fleetctl-workstations-canary.yml b/.github/workflows/fleetctl-workstations-canary.yml deleted file mode 100644 index 26c3919766..0000000000 --- a/.github/workflows/fleetctl-workstations-canary.yml +++ /dev/null @@ -1,49 +0,0 @@ -# This workflow applies the latest configuration profiles (macOS settings) and macOS updates minimum version and deadline to the workstations (canary) team. -# It uses a fleet instance also built and executed from source. -# -# It runs automatically when a file is changed in /mdm_profiles. -name: Apply latest configuration profiles and macOS updates (Canary) - -on: - push: - branches: - - main - paths: - - "mdm_profiles/**.mobileconfig" - - ".github/workflows/fleetctl-workstations-canary.yml" - workflow_dispatch: # Manual - -# This allows a subsequently queued workflow run to interrupt previous runs -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} - cancel-in-progress: true - -defaults: - run: - # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference - shell: bash - -permissions: - contents: read - -env: - DOGFOOD_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }} - DOGFOOD_URL: ${{ secrets.DOGFOOD_URL }} - CLOUD_MANAGEMENT_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }} - -jobs: - apply-profiles: - timeout-minutes: 5 - runs-on: ubuntu-latest - steps: - - name: Apply configuration profiles and updates - uses: fleetdm/fleet-mdm-gitops@15072f2739ef92c6357414ddd86e89b6bf302a2b # v1.1.0 - with: - FLEET_API_TOKEN: $DOGFOOD_API_TOKEN - FLEET_URL: $DOGFOOD_URL - FLEET_TEAM_NAME: š»š£ Workstations (canary) - MDM_CONFIG_REPO: fleetdm/fleet - MDM_CONFIG_DIRECTORY: mdm_profiles - MAC_OS_MIN_VERSION: "14.2" - MAC_OS_VERSION_DEADLINE: 2023-12-15 - MAC_OS_ENABLE_DISK_ENCRYPTION: true diff --git a/.github/workflows/fleetctl-workstations.yml b/.github/workflows/fleetctl-workstations.yml deleted file mode 100644 index fb45ddac96..0000000000 --- a/.github/workflows/fleetctl-workstations.yml +++ /dev/null @@ -1,49 +0,0 @@ -# This workflow applies the latest configuration profiles (macOS settings) and macOS updates minimum version and deadline to the workstations team. -# It uses a Fleet instance also built and executed from source. -# -# It runs when the GitHub action is triggered manually -name: Apply latest configuration profiles and macOS updates - -on: - push: - branches: - - main - paths: - - "mdm_profiles/**.mobileconfig" - - ".github/workflows/fleetctl-workstations.yml" - workflow_dispatch: # Manual - -# This allows a subsequently queued workflow run to interrupt previous runs -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} - cancel-in-progress: true - -defaults: - run: - # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference - shell: bash - -permissions: - contents: read - -env: - DOGFOOD_API_TOKEN: ${{ secrets.DOGFOOD_API_TOKEN }} - DOGFOOD_URL: ${{ secrets.DOGFOOD_URL }} - CLOUD_MANAGEMENT_ENROLLMENT_TOKEN: ${{ secrets.CLOUD_MANAGEMENT_ENROLLMENT_TOKEN }} - -jobs: - apply-profiles: - timeout-minutes: 5 - runs-on: ubuntu-latest - steps: - - name: Apply configuration profiles and updates - uses: fleetdm/fleet-mdm-gitops@15072f2739ef92c6357414ddd86e89b6bf302a2b # v1.1.0 - with: - FLEET_API_TOKEN: $DOGFOOD_API_TOKEN - FLEET_URL: $DOGFOOD_URL - FLEET_TEAM_NAME: š» Workstations - MDM_CONFIG_REPO: fleetdm/fleet - MDM_CONFIG_DIRECTORY: mdm_profiles - MAC_OS_MIN_VERSION: "14.2" - MAC_OS_VERSION_DEADLINE: 2023-12-19 - MAC_OS_ENABLE_DISK_ENCRYPTION: true diff --git a/.github/workflows/test-puppet.yml b/.github/workflows/test-puppet.yml index 0b8f3c2382..82531fc272 100644 --- a/.github/workflows/test-puppet.yml +++ b/.github/workflows/test-puppet.yml @@ -7,7 +7,7 @@ on: - patch-* pull_request: paths: - - 'ee/tools/puppet/fleetdm/*.*' + - 'ee/tools/puppet/fleetdm/**' - '.github/workflows/test-puppet.yml' workflow_dispatch: # Manual diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml deleted file mode 100644 index 37f535258b..0000000000 --- a/.github/workflows/tfsec.yml +++ /dev/null @@ -1,48 +0,0 @@ -name: tfsec - -on: - push: - branches: - - main - paths: - - '**.tf' - pull_request: - paths: - - '**.tf' - workflow_dispatch: # Manual dispatch - -# This allows a subsequently queued workflow run to interrupt previous runs -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} - cancel-in-progress: true - -defaults: - run: - # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference - shell: bash - -permissions: - contents: read - -jobs: - tfsec: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: tfsec sarif report - runs-on: ubuntu-latest - - steps: - - name: Clone repo - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b - - - name: tfsec - uses: tfsec/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 - with: - sarif_file: tfsec.sarif - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: tfsec.sarif diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml new file mode 100644 index 0000000000..0d362fe9b4 --- /dev/null +++ b/.github/workflows/trivy-scan.yml @@ -0,0 +1,53 @@ +name: Trivy vulnerability scan +on: + push: + branches: + - main + paths: + - "**.tf" + pull_request: + paths: + - "**.tf" + workflow_dispatch: + schedule: + - cron: "0 4 * * *" # Nightly 4AM UTC + +# This allows a subsequently queued workflow run to interrupt previous runs +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} + cancel-in-progress: true + +defaults: + run: + # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference + shell: bash + +permissions: + contents: read + +jobs: + trivy: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Trivy sarif report + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 + + - name: Run Trivy vulnerability scanner in repo mode + uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # 0.18.0 + with: + scan-type: "fs" + ignore-unfixed: false + format: "sarif" + output: "trivy-results.sarif" + severity: "CRITICAL,HIGH,MEDIUM,LOW" + trivyignores: ".trivyignore" + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + with: + sarif_file: "trivy-results.sarif" diff --git a/.github/workflows/trivy_scan.yml b/.github/workflows/trivy_scan.yml deleted file mode 100644 index cc31bb39cc..0000000000 --- a/.github/workflows/trivy_scan.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Trivy vulnerability scan -on: - workflow_dispatch: - schedule: - - cron: '0 4 * * *' # Nightly 4AM UTC -jobs: - build: - name: Trivy - runs-on: ubuntu-20.04 - steps: - - name: Checkout code - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - - - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@8bd2f9fbda2109502356ff8a6a89da55b1ead252 # master - with: - scan-type: 'fs' - ignore-unfixed: true - format: 'sarif' - output: 'trivy-results.sarif' - severity: 'CRITICAL' - skip-dirs: 'website/,tools/,infrastructure/,test/,orbit/pkg/insecure/' - trivyignores: '.trivyignore' - security-checks: 'vuln' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.2.5 - with: - sarif_file: 'trivy-results.sarif' diff --git a/CHANGELOG.md b/CHANGELOG.md index 79c5d92192..1ba584f34c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,19 @@ +## Fleet 4.46.1 (Feb 27, 2024) + +### Bug fixes + +* Fixed a bug in running queries via API. + - Query campaign not clearing from Redis after timeout +* Added logging when a Redis connection is blocked for a long time waiting for live query results. +* Added support for the `redis.conn_wait_timeout` configuration setting for Redis standalone (it was previously only supported on Redis cluster). +* Added Redis cleanup of inactive queries in a cron job, so temporary Redis failures to stop a live query doesn't leave such queries around for a long time. +* Fixed orphaned live queries in Redis when client terminates connection + - `POST /api/latest/fleet/queries/{id}/run` + - `GET /api/latest/fleet/queries/run` + - `POST /api/latest/fleet/hosts/identifier/{identifier}/query` + - `POST /api/latest/fleet/hosts/{id}/query` +* Added --server_frequent_cleanups_enabled (FLEET_SERVER_FREQUENT_CLEANUPS_ENABLED) flag to enable cron job to clean up stale data running every 15 minutes. Currently disabled by default. + ## Fleet 4.46.0 (Feb 26, 2024) ### Changes diff --git a/CODEOWNERS b/CODEOWNERS index 52f1680b77..eba3b36a49 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -84,15 +84,16 @@ go.mod @fleetdm/go # # (see website/config/custom.js for DRIs of other paths not listed here) ############################################################################################## -/handbook/company @mikermcneil -/handbook/README.md @mikermcneil -/handbook/business-operations @sampfluger88 -/handbook/digital-experience @sampfluger88 -/handbook/customer-success @sampfluger88 -/handbook/demand @sampfluger88 -/handbook/engineering @sampfluger88 -/handbook/sales @sampfluger88 -/handbook/product-design @sampfluger88 +/handbook/company @mikermcneil +/handbook/README.md @mikermcneil +/handbook/business-operations @sampfluger88 +/handbook/digital-experience @sampfluger88 +/handbook/customer-success @sampfluger88 +/handbook/demand @sampfluger88 +/handbook/engineering @sampfluger88 @lukeheath +/handbook/sales @sampfluger88 +/handbook/product-design @sampfluger88 +/handbook/company/product-groups @sampfluger88 @lukeheath ############################################################################################## # 𦿠GitHub issue templates diff --git a/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md b/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md new file mode 100644 index 0000000000..72d6535287 --- /dev/null +++ b/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md @@ -0,0 +1,81 @@ +# The device security tightrope: balancing cost and protection in K-12 schools + + + +In today's digital classrooms, the diversity of devices and operating systemsāfrom Macs and Windows to Linux and Chromebooksāpresents unique challenges for K-12 schools. As technology becomes increasingly integral to education, the complexity of managing cybersecurity risks grows. The task is daunting: ensuring robust protection against cyber threats while grappling with limited budgets and IT resources. In August 2023, the [U.S. Department of Education highlighted these challenges](https://www.ed.gov/news/press-releases/department-of-education-announces-k-12-cybersecurity-resilience-efforts), emphasizing the need for schools to balance cost with effective cybersecurity measures. This blog post delves into the evolving landscape of digital education, exploring strategies for K-12 schools to navigate the precarious balance between securing their digital infrastructure and managing costs efficiently. Drawing on recent governmental efforts and expert insights, we'll outline actionable steps to lead to a more secure and enriching learning environment for all. + + +## The growing cybersecurity challenge in education + +In August 2023 U.S. Department of Education posted a press release, ā[Key K-12 Cybersecurity Resilience Efforts](https://www.ed.gov/news/press-releases/department-of-education-announces-k-12-cybersecurity-resilience-efforts),ā discussing the growing security challenges for educational institutions. U.S. Secretary of Education Miguel Cardona is quoted as saying, + +
Letās face it: in todayās digital age, our students and their teachers will increasingly use technology in the classroom. Schools have access to more devices and connectivity than ever before, and this technology in education has incredible potential to help students better connect with their learning and achieve, and teachers better engage with their students. But to make the most of these benefits, we must effectively manage the risks. Just as we expect everyone in a school system to plan and prepare for physical risks, we must now also ensure everyone helps plan and prepare for digital risks in our schools and classrooms. The Department of Education has listened to the field about the importance of K-12 cybersecurity, and today we are coming together to recognize this and indicate our next steps. ++ + +## National attention on cybersecurity in schools + +Even the White House is showing concerns. In August 2023, the White House sponsored The White Houseās Back to School Safely: Cybersecurity Summit for K-12 Schools. They discussed the challenges educators, students, and families face in this increasing number of devices schools have to support, as well as the publication by the Department's Office of Educational Technology and CISA titled "K-12 Digital Infrastructure Brief: Defensible and Resilient." Key considerations include: + + + + + +* **Enhancing continuous risk management:** Addressing the ever-evolving threat landscape by proactively managing cybersecurity risks. +* **Utilizing analogies for understanding:** Leveraging lessons from physical world scenarios to comprehensively grasp and tackle cybersecurity challenges. +* **Prioritizing and implementing mitigation strategies:** Identifying the most critical risks and applying effective mitigations such as multi-factor authentication, robust password policies, phishing prevention, and regular software updates. +* **Building resilience for cyber incidents:** Developing and practicing cyber incident response plans to minimize the impact of potential cybersecurity breaches. +* **Vendor engagement for enhanced security:** Encouraging vendors to invest in secure design principles, obtain cyber risk assurance certifications, and establish security vulnerability disclosure practices. + + +## The overlooked factor: balancing cost and security + +Juan Hernandez's article in [The Prey Project in August 2023](https://preyproject.com/blog/device-security-policies-it-schools) discusses why device management is essential for K-12 schools. Hernandezās article doesnāt address one of the most significant factors, cost. Today K-12 schools struggle with tight budgets, lack of technical resources, and overworked IT and educator staff require school districts to walk a tightrope between cost and risk. Below are a few considerations designed to help schools with this balancing act. + + +## Strategies for cost-effective cybersecurity in schools + + + +* **Embrace open-source:** Consider open-source solutions for their affordability, agility, and strong community support. +* **Cost-effectiveness:** Explore solutions that replace redundant, unused tools and avoid vendor lock-in. +* **Converge IT solutions:** Integrate tools and processes into IT operations for a holistic approach. +* **Consolidate and automate tasks:** Integrate and automate IT operations to reduce redundancy and free up staff for strategic initiatives. +* **Prioritize updates:** Act fast on critical patches to minimize vulnerabilities. Be intentional about what you patch. Focus on known exploits and vulnerabilities that exist in your environment first. +* **Implement endpoint protection:** Defend against cyber threats like ransomware to safeguard sensitive data. +* **User education:** Empower users with cybersecurity awareness training and offer transparency about data collection to build trust. + + +## Additional considerations for a comprehensive approach to cybersecurity + + + +* **Compliance:** Ensure adherence to data privacy regulations like COPPA, FERPA, and GDPR. +* **Continuous adaptation:** Regularly evaluate and adapt your security posture to stay ahead of evolving threats. + + +## Creating a secure and affordable digital learning environment + +In navigating the complex landscape of device security in K-12 schools, it's clear that a balanced approach is not just beneficial; it's necessary. Schools can protect their digital environments by integrating cost-effective strategies with robust cybersecurity measures without straining their budgets. As we've explored, this involves embracing open-source solutions, prioritizing critical updates, and fostering a culture of cybersecurity awareness among all users. + +We understand that every school's situation is unique, with its specific challenges and resources. Therefore, we encourage educational institutions to consider and adapt the strategies discussed here to fit their unique circumstances. Implementing these practices may require time and effort, but the payoff in enhanced security and peace of mind is invaluable. + + +## Let's start a conversation + +How does your school balance the demands of cybersecurity with budget limitations? Have you found innovative solutions or faced particular challenges in this journey? Share your stories, questions, and insights with us. Your experiences enrich our collective understanding and contribute to building a resilient, informed, and supportive community around the critical issue of K-12 cybersecurity. + +Join the dialogue in our community [Fleet Slack channels](https://fleetdm.com/support) to exchange ideas, ask questions, and connect with peers navigating similar challenges. Your input is vital in shaping effective and sustainable cybersecurity practices in education. + +Together, we can create safer digital spaces for our students and educators, ensuring that technology remains a powerful tool for learning and growth, not a vulnerability. + + + + + + + + + + + diff --git a/changes/10488-remote-wipe b/changes/10488-remote-wipe new file mode 100644 index 0000000000..e180b89c90 --- /dev/null +++ b/changes/10488-remote-wipe @@ -0,0 +1 @@ +* Added the `POST /api/v1/fleet/hosts/:id/wipe` Fleet Premium API endpoint to support remote wiping a host. diff --git a/changes/15461-host-dep-assign-profile-responses b/changes/15461-host-dep-assign-profile-responses new file mode 100644 index 0000000000..4bb2178425 --- /dev/null +++ b/changes/15461-host-dep-assign-profile-responses @@ -0,0 +1 @@ +- Added functionality to surface MDM devices where DEP assignment failed. \ No newline at end of file diff --git a/changes/16242-policy-data-for-hosts b/changes/16242-policy-data-for-hosts new file mode 100644 index 0000000000..d5a5eeae85 --- /dev/null +++ b/changes/16242-policy-data-for-hosts @@ -0,0 +1 @@ +GET /hosts API endpoint can now populate policies with populate_policies=true query parameter. diff --git a/changes/16331-address-redis-issues-live-query b/changes/16331-address-redis-issues-live-query deleted file mode 100644 index d5796f8967..0000000000 --- a/changes/16331-address-redis-issues-live-query +++ /dev/null @@ -1,3 +0,0 @@ -* Added logging when a Redis connection is blocked for a long time waiting for live query results. -* Added support for the `redis.conn_wait_timeout` configuration setting for Redis standalone (it was previously only supported on Redis cluster). -* Added Redis cleanup of inactive queries in a cron job, so temporary Redis failures to stop a live query doesn't leave such queries around for a long time. diff --git a/changes/16341-fix-device-user-spacing b/changes/16341-fix-device-user-spacing new file mode 100644 index 0000000000..b4ea7a2c3e --- /dev/null +++ b/changes/16341-fix-device-user-spacing @@ -0,0 +1 @@ +- Updates to spacing on device user page \ No newline at end of file diff --git a/changes/16350-no-team-live-queries b/changes/16350-no-team-live-queries new file mode 100644 index 0000000000..8444e48294 --- /dev/null +++ b/changes/16350-no-team-live-queries @@ -0,0 +1 @@ +* Add a "No team" team option when running live queries from the UI diff --git a/changes/16350-target-no-team-for-live-query b/changes/16350-target-no-team-for-live-query new file mode 100644 index 0000000000..7095c3cfe0 --- /dev/null +++ b/changes/16350-target-no-team-for-live-query @@ -0,0 +1,2 @@ +- API endpoint GET fleet/targets/count can target 'No team' with team_id=0 +- API endpoint POST fleet/queries/run (for async live queries) can target 'No team' with team_id=0 diff --git a/changes/16593-disk-encryption-verifying b/changes/16593-disk-encryption-verifying new file mode 100644 index 0000000000..44e531026d --- /dev/null +++ b/changes/16593-disk-encryption-verifying @@ -0,0 +1 @@ +* Display disk encryption status in macOS as "verifying" while Fleet verifies if the escrowed key can be decrypted. diff --git a/changes/16608-search-target-icon b/changes/16608-search-target-icon new file mode 100644 index 0000000000..50ca4e4179 --- /dev/null +++ b/changes/16608-search-target-icon @@ -0,0 +1 @@ +- Fix position of live query/poilcy host search icon diff --git a/changes/16663-pencil-icon-alignment b/changes/16663-pencil-icon-alignment new file mode 100644 index 0000000000..4bf6aa5d6e --- /dev/null +++ b/changes/16663-pencil-icon-alignment @@ -0,0 +1,2 @@ +- Fix a bug where the pencil icons next to the edit query name and description fields were + inconsistently spaced. diff --git a/changes/16858-vuln-processing-optimization b/changes/16858-vuln-processing-optimization new file mode 100644 index 0000000000..52f1a99710 --- /dev/null +++ b/changes/16858-vuln-processing-optimization @@ -0,0 +1 @@ +Reduced vulnerability processing time by grouping vulnerability dictionary by vendor. diff --git a/changes/16859-vuln-unicode-err b/changes/16859-vuln-unicode-err new file mode 100644 index 0000000000..b974f7cb1f --- /dev/null +++ b/changes/16859-vuln-unicode-err @@ -0,0 +1 @@ +- fixed error during vulnerability processing on non-ascii software names \ No newline at end of file diff --git a/changes/16950-transfer-selected-all-hosts b/changes/16950-transfer-selected-all-hosts new file mode 100644 index 0000000000..d4b619600d --- /dev/null +++ b/changes/16950-transfer-selected-all-hosts @@ -0,0 +1 @@ +- Bug fix: Correctly transfer hosts on multiple pages between teams diff --git a/changes/17091-team-host-status-webhook b/changes/17091-team-host-status-webhook new file mode 100644 index 0000000000..220a13d54f --- /dev/null +++ b/changes/17091-team-host-status-webhook @@ -0,0 +1 @@ +- Implement the UI for the team-specific host status webhook feature. diff --git a/changes/17094-per-team-host-status-webhook b/changes/17094-per-team-host-status-webhook new file mode 100644 index 0000000000..56eaf2dd73 --- /dev/null +++ b/changes/17094-per-team-host-status-webhook @@ -0,0 +1 @@ +Enabling setting host status webhook at the team level via REST API and fleetctl apply/gitops. diff --git a/changes/17197-cleanup-campaign-when-ctx-canceled b/changes/17197-cleanup-campaign-when-ctx-canceled deleted file mode 100644 index 7ff75f5515..0000000000 --- a/changes/17197-cleanup-campaign-when-ctx-canceled +++ /dev/null @@ -1 +0,0 @@ -* Fix orphaned live queries in Redis when client terminates connection (`POST /api/latest/fleet/queries/{id}/run`, `GET /api/latest/fleet/queries/run`, `POST /api/latest/fleet/hosts/identifier/{identifier}/query` and `POST /api/latest/fleet/hosts/{id}/query`). diff --git a/changes/17232-cert-renewal-auth b/changes/17232-cert-renewal-auth new file mode 100644 index 0000000000..9cc7f9b2cd --- /dev/null +++ b/changes/17232-cert-renewal-auth @@ -0,0 +1 @@ +* Prevent running cleanup tasks and re-enqueuing commands for hosts on SCEP renewals. diff --git a/changes/fix-16335-copy b/changes/fix-16335-copy new file mode 100644 index 0000000000..69e4d38ce7 --- /dev/null +++ b/changes/fix-16335-copy @@ -0,0 +1 @@ +- Updates copy in `fleetctl` error when attempting to upload malformed profiles. \ No newline at end of file diff --git a/changes/issue-10489-ui-for-wiping-host b/changes/issue-10489-ui-for-wiping-host new file mode 100644 index 0000000000..066cc8f06e --- /dev/null +++ b/changes/issue-10489-ui-for-wiping-host @@ -0,0 +1 @@ +- add UI for wiping a host with fleet mdm. diff --git a/changes/issue-10494-add-wipe-cli b/changes/issue-10494-add-wipe-cli new file mode 100644 index 0000000000..5184225b79 --- /dev/null +++ b/changes/issue-10494-add-wipe-cli @@ -0,0 +1 @@ +- add wipe command to fleetctl diff --git a/changes/issue-16837-rollup-of-mdm-solutions b/changes/issue-16837-rollup-of-mdm-solutions new file mode 100644 index 0000000000..594a4571df --- /dev/null +++ b/changes/issue-16837-rollup-of-mdm-solutions @@ -0,0 +1 @@ +- rollup the mdm solutions by name on the dashboard mdm card diff --git a/changes/jve-16335 b/changes/jve-16335 new file mode 100644 index 0000000000..692f761ccf --- /dev/null +++ b/changes/jve-16335 @@ -0,0 +1 @@ +- Enables usage of `
- An example request sent to your configured Destination URL. -
-@@ -210,6 +178,7 @@ const HostStatusWebhook = ({ name="hostStatusWebhookDaysCount" value={hostStatusWebhookDaysCount} parseTarget + searchable={false} onBlur={validateForm} tooltip={
@@ -234,8 +203,11 @@ const HostStatusWebhook = ({
Reduce time wasted hunting down whether a change happened. Actually verify that settings are applied using real data pulled from your users' devices.
+Spend less time debugging whether changes actually happened. Auto-verify using real data pulled from your users' devices.
Use a git repo as the source of truth to reduce errors (submitting the wrong patch, configuration setting etc)
Every change to a policy or security control is tracked and auditable in Fleetās history, or via the repo commit log
+Instantly reveal failed patches and broken settings with osquery to shorten the feedback loop and uncover problems sooner.
+
Consolidate your security tooling on top of open data standards like YAML, SQL, and JSON.
- Ship data to any platform -Export anything. Ship data to any platform like Splunk, Snowflake, or any streaming infrastructure like AWS Kinesis and Apache Kafka.
Pulse check anything -Simplify security audits, build definitive reports, and discover and verify ongoing compliance for every endpoint, from workstations to data centers.
+Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.
+ Ship data to any platform +Ship logs to any platform like Splunk, Snowflake, or any streaming infrastructure like AWS Kinesis and Apache Kafka.
+ Osquery on easy mode +You donāt need to be an osquery expert to get the answers you need from your devices, Fleet does some of that for you.
Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.
+Talk to online devices in real time with Fleetās live query API. Implement custom workflows like conditional access based on device posture, Identity, and more.
+Get visibility into all endpoints across any operating system*, including support for servers and containers in every cloud infrastructure.
+Identify who logs in to any system, including login history and current sessions. Look up any computer by the email address of the person using it.
+Keep all your endpoints* compliant with customizable baselines, or use common benchmarks like CIS.
+Gate access with common device trust policies from industry peers, or roll out your own device health checks using system data and events.
+Track progress towards deadlines for security posture remediation projects, and enforce due dates through automations.
+*Currently limited to: macOS, Linux, Windows, Chromebooks, OT, data centers, Amazon Web Services (AWS), Google Cloud (GCP), and the Microsoft Cloud (Azure).
+Export anything. Ship data to any platform like Splunk, Snowflake, or any streaming infrastructure like AWS Kinesis and Apache Kafka.
+Extract data and correlate it with your log aggregator, SIEM, or data lake.
+Ease your logging burden, pull the data you need.
+
+
+ Accelerate deployment and get more out of osquery. You donāt need to be an osquery expert to get the answers you need from your devices, Fleet takes care of some of that for you.
+Remotely disable/enable agent features, choose plugins, and keep osquery up to date.
+Import community queries from other security teams at top brands like Palantir and Fastly.
+Implement the Center for Internet Security (CIS) benchmarks (one click, 400+ queries, supported by Fleet). Or customize exactly the queries you need.
+Consolidate your security tooling on top of open data standards like YAML, SQL, and JSON.
*Companies like Fastly and Gusto use Fleet in production with hundreds of thousands of endpoints, including containers, OT, and laptops.
Export anything. Ship data to any platform like Splunk, Snowflake, or any streaming infrastructure like AWS Kinesis and Apache Kafka.
-Extract data and correlate it with your log aggregator, SIEM, or data lake.
-Ease your logging burden, pull the data you need.
-
- Simplify security audits, build definitive reports, and discover and verify ongoing compliance for every endpoint, from workstations to data centers.
-Get visibility into all endpoints across any operating system*, including support for servers and containers in every cloud infrastructure.
-Verify that your EDR tools are installed and working so you can identify and address configuration issues quickly.
-Keep all your endpoints* compliant with customizable baselines, or use common benchmarks like CIS.
-Identify who logs in to any system, including login history and current sessions.Ā Look up any computer by the email address of the person using it.
-Enforce secure configurations and safe, up-to-date software through automations.
-*Currently limited to: macOS, Linux, Windows, Chromebooks, OT, data centers, Amazon Web Services (AWS), Google Cloud (GCP), and the Microsoft Cloud (Azure).
-
- Accelerate deployment and get more out of osquery. You donāt need to be an osquery expert to get the answers you need from your devices, Fleet takes care of some of that for you.
-Remotely disable/enable agent features, choose plugins, and keep osquery up to date.
-Import community queries from other security teams at top brands like Palantir and Fastly.
-Implement the Center for Internet Security (CIS) benchmarks (one click, 400+ queries, supported by Fleet). Or customize exactly the queries you need.
-Install the fleetctl command line tool:
curl -SsLO https://fleetdm.com/resources/install-fleet.sh -o install_fleet.sh && shasum -a 256 install_fleet.sh
curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash
Run a local demo of the Fleet server:
@@ -45,7 +45,7 @@Install the fleetctl command line tool:
curl -SsLO https://fleetdm.com/resources/install-fleet.sh -o install_fleet.sh && shasum -a 256 install_fleet.sh
curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash
Run a local demo of the Fleet server:
diff --git a/website/views/pages/homepage.ejs b/website/views/pages/homepage.ejs index 695cc744cc..611cfd952d 100644 --- a/website/views/pages/homepage.ejs +++ b/website/views/pages/homepage.ejs @@ -7,7 +7,7 @@ <%/* Hero text */%>Replace the sprawl with open-source code that works the way you want.
+
+
Consolidate your point vulnerability solution with your cybersecurity asset management and log capture tools.
+Use open data and APIs to connect your point vulnerability solution with your cybersecurity asset management and log capture tools.
Prevent duplicated, inaccurate CMDBs to reduce tool sprawl and wasted budget
Normalize asset management data and software inventories from multiple tools and operating systems
diff --git a/website/views/partials/primary-tagline.partial.ejs b/website/views/partials/primary-tagline.partial.ejs new file mode 100644 index 0000000000..debe33a902 --- /dev/null +++ b/website/views/partials/primary-tagline.partial.ejs @@ -0,0 +1 @@ +<%= primaryBuyingSituation === 'mdm' ? 'Your last MDM migration' : 'Focus on data, not vendors' %>