Update doc assets (#33740)
After talking with eng team and @nonpunctual, the /assets folder is reserved for things inside the fleet app, so creating a new folder in `/docs/solutions` @AdamBaali - I updated your article paths and moved the assets to the new folder, do you mind taking a peek and making sure it looks good? Note: brock, we should also update handbook for new ritual to add articles with assets like this. --------- Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
This commit is contained in:
co-authored by
Brock Walters
parent
75104bfbcb
commit
9e3cab666e
@@ -65,7 +65,7 @@ Below is an explanation of what each of the macOS CrowdStrike Falcon payloads do
|
||||
- `crowdstrike-web-filter.mobileconfig` - Enable web filtering to monitor network traffic at the socket level.
|
||||
- `crowdstrike-full-disk-access.mobileconfig` - Grant full disk access to all CrowdStrike application processes using the CrowdStrike Apple Developer team identifier.
|
||||
|
||||
[Download the CrowdStrike Falcon macOS Configuration Profiles](https://github.com/fleetdm/fleet/tree/main/assets/configuration-profiles)
|
||||
[Download the CrowdStrike Falcon macOS Configuration Profiles](https://github.com/fleetdm/fleet/tree/main/docs/solutions/configuration-profiles)
|
||||
|
||||
>To upload Configuration Profiles to your Fleet instance: go to **Controls > OS Settings > Custom settings** then click **Add Profile**. See the screen shot below for details.
|
||||
|
||||
|
||||
@@ -16,13 +16,13 @@ Together, these components create a self-healing enforcement loop that ensures p
|
||||
|
||||
One way to harden the installer is to apply registry values through a PowerShell script. These values help prevent uninstallation or tampering of protected applications.
|
||||
|
||||
[Windows hardening PowerShell script](https://github.com/fleetdm/fleet/blob/main/assets/scripts/windows-fleet-hardening.ps1)
|
||||
[Windows hardening PowerShell script](https://github.com/fleetdm/fleet/blob/main/docs/solutions/scripts/windows-fleet-hardening.ps1)
|
||||
|
||||
## Policies in Fleet
|
||||
|
||||
A Fleet policy confirms that the hardened registry key exists. If the key is missing, the policy fails, triggering automation to rerun the script. Once applied, the policy becomes compliant. If tampering occurs later, the cycle repeats.
|
||||
|
||||
[Fleet policy for Windows hardening](https://github.com/fleetdm/fleet/blob/main/assets/policies/windows-fleet-hardening.policies.yml)
|
||||
[Fleet policy for Windows hardening](https://github.com/fleetdm/fleet/blob/main/docs/solutions/policies/windows-fleet-hardening.policies.yml)
|
||||
|
||||
> Note: On first run, this policy intentionally fails to ensure automation executes the hardening script.
|
||||
|
||||
@@ -30,7 +30,7 @@ A Fleet policy confirms that the hardened registry key exists. If the key is mis
|
||||
|
||||
A Windows configuration profile can prevent devices from unenrolling from MDM. This is a separate measure from the policy and script but adds another layer of protection.
|
||||
|
||||
[Block MDM unenrollment configuration profile](https://github.com/fleetdm/fleet/blob/main/assets/configuration-profiles/BlockMDMUnenrollment.xml)
|
||||
[Block MDM unenrollment configuration profile](https://github.com/fleetdm/fleet/blob/main/docs/solutions/configuration-profiles/BlockMDMUnenrollment.xml)
|
||||
|
||||
[Microsoft CSP reference](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowmanualmdmunenrollment): The `AllowManualMDMUnenrollment` CSP is only supported on certain versions of Windows. Verify compatibility before deployment.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user