Host search improvement: Search hosts by username (system user)

[Zaulao]

Goal

This suggestion is intended to enable Fleet administrators, maintainers or observers to search for hosts through host usernames.

After fleet 4.5.0 updates, a list of system users is made available on the Host details page. It would be great to be able to enter a username in the search field and get the hosts on which that user is present in response.

How?

Step 1: Insert the username to search for

Step 2: Wait for the hostname to show up

In this example, the user mark.weiser is currently present (or logged in) on machine host-554234.

-[]

[mikermcneil]

@Zaulao I love this feature. Some thoughts:

1. We need to take into consideration how the search will perform for deployments with large numbers of hosts (100k+), in terms of the MySQL database (I think this is "whose" kind of subquery)
2. Which system user from the host details page (e.g. /hosts/4) would you ideally want to show up as a match when searching? (Thoughts on how to write an osquery query for that?)

[Zaulao]

Hello @mikermcneil

First, I agree with your concern about the performance of such feature in large deployments. The main objective of this feature, at least for me, is to be able to make the link between logged in users and machines. Therefore, the query I use to perform such link is as follows:

SELECT user FROM logged_in_users where user like '...'

I run this query on all machines with the hope that one of them, which is online at the time of execution of the query, presents the referred user.

[mikermcneil]

Thanks for the info @Zaulao! Fleet is already storing system users as part of host vitals (i.e. what you see on the host details page), so, at a glance, this seems doable to me.

@noahtalerman Shall we look into this next week?

[mikermcneil]

This search should probably be skipped right?

[Zaulao]

Yeah, I agree

[noahtalerman]

Think about the UX for the one to one device to attribute mapping v. the filter use case when designing the changes to the Fleet UI to support this ability.