<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
## Summary
Applies Fleet's article-formatting house style to 17 articles.
Content/prose only — no code, config, or schema changes.
Each article now follows the house structure: sentence-case `# Title`,
italic dek, **Key takeaways** (5–6 outcome-first bullets placed above
the fold), a post-takeaways CTA button, a tightened two-paragraph intro,
a terminology sweep (customer-facing "osquery" → "Fleet's
agent"/"fleetd", sentence-case headings), de-duplication, and format
trimming. Detection-pack SQL, IOC/reference tables, and code blocks were
left intact. All `<meta>` tags (including `category` values) and author
fields were preserved unchanged.
Articles updated:
- shadow-ai-is-already-on-your-fleet
- clickfix-copy-paste-fleet-detection-pack
- shadow-earth-053-fleet-detection-pack
- microsoft-is-rotating-every-windows-pcs-secure-boot-keys
- pre-cve-threat-response-with-fleet
- managing-linux-desktops-with-gitops
- patch-management-and-vulnerability-reporting-for-linux-desktops
- managing-linux-desktop-drift
- linux-desktop-inventory-and-visibility
- zero-trust-endpoint-security
- natural-language-endpoint-security-fleet-mcp
- detecting-the-mini-shai-hulud-npm-supply-chain-worm-with-fleet
- security-compliance-automation
- gitops-for-device-management
- endpoint-management-mixed-platform
- enterprise-device-management-2026
- what-is-device-attestation
## Claims flagged for human review before publishing
**Content issues to reconcile:**
- `detecting-the-mini-shai-hulud`: internal number conflict — intro/IOC
say "175 additional packages", SQL section says "133 additional packages
across 322 versions". Left as-is; pick one.
- `linux-desktop-inventory-and-visibility`: "IdP group" was removed as a
label type (couldn't confirm). Fleet does support IdP/SSO-group labels —
likely should be restored.
- `shadow-earth-053`: an ambiguous "17 validated queries" count was
removed (15 numbered queries, some with two statements). Re-add a number
if desired.
**Claims softened for honesty (revert only if the stronger version can
be backed):**
- `managing-linux-desktops-with-gitops`: two absolute "only MDM/only
platform with native GitOps" claims softened.
- `gitops-for-device-management`: unverifiable "up to three retry
attempts" number dropped; confirm CIS policies are Premium-gated.
- `endpoint-management-mixed-platform`: "enforces OS updates across
every supported platform" → "major platforms" (excludes Linux/ChromeOS);
confirm Entra conditional-access "macOS and Windows" scope.
**Specifics to confirm against fleetdm.com/tables or docs:**
- `shadow-ai`: `mcp_listening_servers` table, `vscode_edition` column,
MCP-client support list.
- `clickfix`: agent-option flags, `powershell_events.cosine_similarity`,
`es_process_events` columns, XProtect Remediator min macOS version.
- `shadow-earth-053`: schema notes and author-hosted download links.
- `microsoft-secure-boot-keys`: Microsoft cert-expiry dates / Event IDs
(author-supplied).
- `natural-language-endpoint-security-fleet-mcp`: fleet-mcp tool
inventory (third-party repo); CTA points to the external
`github.com/karmine05/fleet-mcp`.
# Checklist for submitter
- [x] No user-visible product changes; content/articles only (no
`changes/` file required).
- [x] QA'd rendered structure: each article has one `# Title`, dek,
single Key takeaways section, and one CTA button; code blocks and tables
preserved.
Allen Houchins