See https://goo.gl/zuku4E. > The most obvious remediation here is ensuring your SAML library is extracting the full text of a given XML element when comments are present. Our implementation asks for the innerxml of the NameID field, so it returns the entire text including the comment (See https://goo.gl/KLLXof). By default Go's XML parsing would return the text not including the comment (but including further text after the comment). Both of these options prevent the vulnerability.
Kolide Fleet 
Effective Endpoint Security. At Any Scale.
Kolide Fleet is a state of the art host monitoring platform tailored for security experts. Leveraging Facebook's battle-tested osquery project, Fleet delivers fast answers to big questions. To learn more about Fleet, visit https://kolide.com/fleet.
Documentation for Fleet can be found on GitHub.
Using Fleet
The Web UI
Information about using the Kolide web application can be found in the Application Documentation.
The CLI
If you're interested in learning about the (under development) fleetctl CLI and flexible osquery deployment file format, see the CLI Documentation.
Deploying Osquery and Fleet
Resources for deploying osquery to hosts, deploying the Fleet server, installing Fleet's infrastructure dependencies, etc. can all be found in the Infrastructure Documentation.
Accessing The Fleet API
If you are interested in accessing the Fleet REST API in order to programmatically interact with your osquery installation, please see the API Documentation.
Developing Fleet
Development Documentation
If you're interested in interacting with the Kolide source code, you will find information on modifying and building the code in the Development Documentation.
If you have any questions, please create a GitHub Issue.
Community
Chat
Please join us in the #kolide channel on osquery Slack.
Community Projects
Below are some projects created by Kolide community members. Please submit a pull request if you'd like your project featured.
- davidrecordon/terraform-aws-kolide-fleet - Deploy Fleet into AWS using Terraform.
- deeso/fleet-deployment - Install Fleet on a Ubuntu box.
