From 6416752ec7f5bfc2ad9b52542a1d41f385c78831 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Mon, 8 Apr 2024 17:39:33 -0500 Subject: [PATCH 01/21] Start updating docs to use consistent language about fleetd --- docs/Configuration/agent-configuration.md | 10 +++++----- docs/Configuration/fleet-server-configuration.md | 2 +- docs/Get started/FAQ.md | 2 +- docs/REST API/rest-api.md | 7 +++---- 4 files changed, 10 insertions(+), 11 deletions(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index 78ad27398fa..fc13e3aa621 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -132,7 +132,7 @@ apiVersion: v1 kind: config spec: agent_options: - command_line_flags: # requires Fleet's osquery installer + command_line_flags: # requires Fleet's agent (fleetd) verbose: true disable_watchdog: false logger_path: /path/to/logger @@ -186,7 +186,7 @@ apiVersion: v1 kind: config spec: agent_options: - extensions: # requires Fleet's osquery installer + extensions: # requires Fleet's agent (fleetd) hello_world_macos: channel: 'stable' platform: 'macos' @@ -252,7 +252,7 @@ apiVersion: v1 kind: config spec: agent_options: - extensions: # requires Fleet's osquery installer + extensions: # requires Fleet's agent (fleetd) hello_world_macos: channel: 'stable' platform: 'macos' @@ -284,7 +284,7 @@ apiVersion: v1 kind: config spec: agent_options: - update_channels: # requires Fleet's osquery installer + update_channels: # requires Fleet's agent (fleetd) orbit: stable osqueryd: '5.10.2' desktop: edge @@ -294,7 +294,7 @@ apiVersion: v1 kind: config spec: agent_options: - update_channels: # requires Fleet's osquery installer + update_channels: # requires Fleet's agent (fleetd) orbit: edge osqueryd: '5.10.2' # in this configuration `desktop` is assumed to be "stable" diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 04dbe5636e3..4cf230f59c8 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -2563,7 +2563,7 @@ stored in your database. ##### packaging_s3_bucket -This is the name of the S3 bucket to store pre-built Fleetd installers. +This is the name of the S3 bucket to store pre-built Fleet agent (fleetd) installers. - Default value: "" - Environment variable: `FLEET_PACKAGING_S3_BUCKET` diff --git a/docs/Get started/FAQ.md b/docs/Get started/FAQ.md index aaacfd38138..fbb3452a931 100644 --- a/docs/Get started/FAQ.md +++ b/docs/Get started/FAQ.md @@ -12,7 +12,7 @@ Fleet is simple enough to [spin up for yourself](https://fleetdm.com/docs/deploy Fleet provides a standard [Terraform module](https://fleetdm.com/docs/deploy/deploy-on-aws-with-terraform) that deploys Fleet with best practices, along with [cloud cost calculators and reference architectures](https://fleetdm.com/docs/deploy/reference-architectures#cloud-providers) used by some of Fleet’s largest customers with tens and hundreds of thousands of hosts. Fleet Premium customers can also opt for managed hosting provided by Fleet. You can also deploy Fleet anywhere you want. -You can enroll servers and laptops using a simple installer or automatically deliver the agent using your existing tools, such as Chef, Terraform, Munki/autopkg, Ansible, Puppet, Jamf, Intune, etc. +You can enroll servers and laptops using a simple installer or automatically deliver Fleet's agent (fleetd) using your existing tools, such as Chef, Terraform, Munki/autopkg, Ansible, Puppet, Jamf, Intune, etc. By default, Fleet keeps agents up to date automatically. For self-managed instances, Fleet provides a [migration runner](https://fleetdm.com/docs/deploy/upgrading-fleet#upgrading-fleet). diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 4d7de797126..2faa9ff6332 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -3243,7 +3243,7 @@ This report includes a subset of host vitals, and simplified policy and vulnerab Currently supports Windows and MacOS. On MacOS this requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's osquery installers](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). Retrieves a host's MDM enrollment status and MDM server URL. @@ -3280,7 +3280,7 @@ If the host exists but is not enrolled to an MDM server, then this API returns ` Currently supports Windows and MacOS. On MacOS this requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's osquery installers](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). Retrieves MDM enrollment summary. Windows servers are excluded from the aggregated data. @@ -3387,8 +3387,7 @@ Retrieves a host's MDM enrollment status, MDM server URL, and Munki version. Requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's osquery -installers](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). Currently supported only on macOS. From 449d9e27fa3d46c1ac4319e1dd87bcfaf391a186 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Mon, 8 Apr 2024 17:54:56 -0500 Subject: [PATCH 02/21] More doc updates for consistent language about fleetd --- docs/Using Fleet/Learn-how-to-use-Fleet.md | 4 ++-- docs/Using Fleet/Supported-host-operating-systems.md | 4 ++-- docs/Using Fleet/enroll-hosts.md | 4 ++-- docs/Using Fleet/fleetctl-CLI.md | 2 +- docs/Using Fleet/update-agents.md | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/Using Fleet/Learn-how-to-use-Fleet.md b/docs/Using Fleet/Learn-how-to-use-Fleet.md index c9dfb74426c..1f14eb23c31 100644 --- a/docs/Using Fleet/Learn-how-to-use-Fleet.md +++ b/docs/Using Fleet/Learn-how-to-use-Fleet.md @@ -17,8 +17,8 @@ To add your device: 1. Select **Add hosts**. In Fleet, devices are referred to as "hosts." 2. Select your device's platform. -3. Select **Download** to download your Fleet osquery installer. The download may take several seconds. -4. Open the Fleet osquery installer and follow the installation steps. +3. Select **Download** to download Fleet's agent (fleetd). The download may take several seconds. +4. Open fleetd and follow the installation steps. > It may take several seconds for Fleet osquery to send your device's data to Fleet. diff --git a/docs/Using Fleet/Supported-host-operating-systems.md b/docs/Using Fleet/Supported-host-operating-systems.md index 8d6729030ae..9733f9751f6 100644 --- a/docs/Using Fleet/Supported-host-operating-systems.md +++ b/docs/Using Fleet/Supported-host-operating-systems.md @@ -19,10 +19,10 @@ Not all osquery tables are available for every OS. Please check out the [osquery If a table is not available for your host, Fleet will generally handle things behind the scenes for you. ### M1 Macs -The osquery installer generated for MacOS by `fleetctl package` does not include native support for M1 Macs. Some values returned may reflect the information returned by Rosetta rather than the system. For example, a CPU will show up as `i486`. +Fleet's agent (fleetd) generated for MacOS by `fleetctl package` does not include native support for M1 Macs. Some values returned may reflect the information returned by Rosetta rather than the system. For example, a CPU will show up as `i486`. ### Linux -The osquery installer will run on Linux distributions where `glibc` is >= 2.2 (there is ongoing work to make osquery work with `glibc` 2.12+). +Fleet's agent (fleetd) will run on Linux distributions where `glibc` is >= 2.2 (there is ongoing work to make osquery work with `glibc` 2.12+). If you aren't sure what version of `glibc` your distribution is using, [DistroWatch](https://distrowatch.com/) is a great resource. > On Linux, Fleet Desktop only supports $DISPLAY `:0`. diff --git a/docs/Using Fleet/enroll-hosts.md b/docs/Using Fleet/enroll-hosts.md index 08e0827af73..67c984a13b9 100644 --- a/docs/Using Fleet/enroll-hosts.md +++ b/docs/Using Fleet/enroll-hosts.md @@ -185,7 +185,7 @@ tables that require access to the [EndpointSecurity API](https://developer.apple If you use plain osquery, instructions are [available here](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/). -On a system with osquery installed via the Fleet osquery installer (fleetd), obtain the +On a system with osquery installed via Fleet's agent (fleetd), obtain the `CodeRequirement` of fleetd by running: ```sh @@ -359,5 +359,5 @@ Applying the environmental variable `"FLEETD_SILENCE_ENROLL_ERROR"=1` on a host This variable is read at launch and will require a restart of the Orbit service if it is not set before installing `fleetd` v1.15.1. - + diff --git a/docs/Using Fleet/fleetctl-CLI.md b/docs/Using Fleet/fleetctl-CLI.md index d83702e46e4..2d6fbca79be 100644 --- a/docs/Using Fleet/fleetctl-CLI.md +++ b/docs/Using Fleet/fleetctl-CLI.md @@ -30,7 +30,7 @@ npm install -g fleetctl@latest ### Available commands -Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate agent (fleetd) installers to add new hosts, get information about existing hosts, and more! +Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate installers for Fleet's agent (fleetd) to add new hosts, get information about existing hosts, and more! To see the available commands you can run: diff --git a/docs/Using Fleet/update-agents.md b/docs/Using Fleet/update-agents.md index 6349ecb941f..78e0d0e40c7 100644 --- a/docs/Using Fleet/update-agents.md +++ b/docs/Using Fleet/update-agents.md @@ -134,7 +134,7 @@ This output is _not sensitive_ and will be shared in agent deployments to verify See the [Enroll hosts docs](https://fleetdm.com/docs/using-fleet/enroll-hosts) for instructions on generating the fleetd agent. -You can use `fleetctl package` to generate installer packages of fleetd (Fleet's bundle of agents that includes a bootstrapped osquery wrapper) to integrate with your Fleet instance. +You can use `fleetctl package` to generate installer packages of Fleet's agent (fleetd) to integrate with your Fleet instance. For example running `fleetctl package --type deb --fleet-url= --enroll-secret=` will build a `.deb` installer with everything needed to communicate with your fleet instance. From 34f77a05d2bbacdbe8006ac874c467408b131d67 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 16:52:45 -0500 Subject: [PATCH 03/21] Update fleetd language in schema/tables --- schema/tables/apfs_physical_stores.yml | 2 +- schema/tables/apfs_volumes.yml | 2 +- schema/tables/authdb.yml | 2 +- schema/tables/cis_audit.yml | 2 +- schema/tables/corestorage_logical_volume_families.yml | 2 +- schema/tables/corestorage_logical_volumes.yml | 2 +- schema/tables/csrutil_info.yml | 2 +- schema/tables/dscl.yml | 2 +- schema/tables/file_lines.yml | 2 +- schema/tables/filevault_prk.yml | 2 +- schema/tables/filevault_users.yml | 2 +- schema/tables/find_cmd.yml | 4 +--- schema/tables/firmware_eficheck_integrity_check.yml | 2 +- schema/tables/google_chrome_profiles.yml | 2 +- schema/tables/icloud_private_relay.yml | 2 +- schema/tables/macadmins_unified_log.yml | 2 +- schema/tables/macos_profiles.yml | 2 +- schema/tables/macos_rsr.yml | 2 +- schema/tables/mdm.yml | 5 ++++- schema/tables/mdm_bridge.yml | 2 +- schema/tables/munki_info.yml | 4 +++- schema/tables/munki_installs.yml | 4 +++- schema/tables/nvram_info.yml | 2 +- schema/tables/orbit_info.yml | 2 +- schema/tables/parse_ini.yml | 2 +- schema/tables/parse_json.yml | 2 +- schema/tables/parse_jsonl.yml | 2 +- schema/tables/parse_xml.yml | 2 +- schema/tables/pmset.yml | 4 +--- schema/tables/puppet_info.yml | 2 +- schema/tables/puppet_logs.yml | 2 +- schema/tables/puppet_state.yml | 2 +- schema/tables/pwd_policy.yml | 4 +--- schema/tables/sntp_request.yml | 4 +--- schema/tables/software_update.yml | 2 +- schema/tables/sudo_info.yml | 2 +- schema/tables/user_login_settings.yml | 2 +- 37 files changed, 44 insertions(+), 45 deletions(-) diff --git a/schema/tables/apfs_physical_stores.yml b/schema/tables/apfs_physical_stores.yml index 44630217fe7..c94aefa7a08 100644 --- a/schema/tables/apfs_physical_stores.yml +++ b/schema/tables/apfs_physical_stores.yml @@ -41,5 +41,5 @@ columns: type: bigint required: false description: The size of the physical store in byptes -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/apfs_volumes.yml b/schema/tables/apfs_volumes.yml index 0f9b331b679..0267e93e241 100644 --- a/schema/tables/apfs_volumes.yml +++ b/schema/tables/apfs_volumes.yml @@ -75,5 +75,5 @@ columns: type: integer required: false description: Whether the volume is unreadable because it does not have a key entered -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/authdb.yml b/schema/tables/authdb.yml index c82894ef644..ac00143dc9c 100644 --- a/schema/tables/authdb.yml +++ b/schema/tables/authdb.yml @@ -13,5 +13,5 @@ columns: required: false description: | The JSON output parsed from the plist output of the `authorizationdb read ` command. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/cis_audit.yml b/schema/tables/cis_audit.yml index 79055e0bda1..343cdad5f9a 100644 --- a/schema/tables/cis_audit.yml +++ b/schema/tables/cis_audit.yml @@ -11,5 +11,5 @@ columns: type: text required: false description: Contains the value for the queried CIS item. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/corestorage_logical_volume_families.yml b/schema/tables/corestorage_logical_volume_families.yml index e1dbd9cf486..36f87e294d4 100644 --- a/schema/tables/corestorage_logical_volume_families.yml +++ b/schema/tables/corestorage_logical_volume_families.yml @@ -76,5 +76,5 @@ columns: type: integer required: false description: Whether a password is currently required to unlock the volume -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false \ No newline at end of file diff --git a/schema/tables/corestorage_logical_volumes.yml b/schema/tables/corestorage_logical_volumes.yml index f23b2083ae5..42548a61ac6 100644 --- a/schema/tables/corestorage_logical_volumes.yml +++ b/schema/tables/corestorage_logical_volumes.yml @@ -129,7 +129,7 @@ columns: type: text required: false description: Name of the filesystem in the logical volume -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/csrutil_info.yml b/schema/tables/csrutil_info.yml index 963cc2535a0..535816cc242 100644 --- a/schema/tables/csrutil_info.yml +++ b/schema/tables/csrutil_info.yml @@ -11,5 +11,5 @@ columns: During system installation, a SHA-256 cryptographic hash is calculated for all immutable system files and stored in a Merkle tree which itself is hashed as the Seal. Both are stored in the metadata of the snapshot created of the System volume. The seal is verified by the boot loader at startup. macOS will not boot if system files have been tampered with. If validation fails, the user will be instructed to reinstall the operating system. During read operations for files located in the Sealed System Volume, a hash is calculated and compared to the value stored in the Merkle tree. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/dscl.yml b/schema/tables/dscl.yml index a17ae334bd8..6698abba00b 100644 --- a/schema/tables/dscl.yml +++ b/schema/tables/dscl.yml @@ -19,5 +19,5 @@ columns: type: text required: false description: The value of the read path and key. The value is the empty string if the key doesn't exist. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/file_lines.yml b/schema/tables/file_lines.yml index 71c3fe07606..1f8b2413c4c 100644 --- a/schema/tables/file_lines.yml +++ b/schema/tables/file_lines.yml @@ -1,5 +1,5 @@ name: file_lines -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Allows reading an arbitrary file. platforms: - darwin diff --git a/schema/tables/filevault_prk.yml b/schema/tables/filevault_prk.yml index bdab68851f0..8797ca12761 100644 --- a/schema/tables/filevault_prk.yml +++ b/schema/tables/filevault_prk.yml @@ -7,5 +7,5 @@ columns: type: text required: false description: The base64-encoded contents of the encrypted FileVault personal recovery key stored at `/var/db/FileVaultPRK.dat` (see also https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow) -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/filevault_users.yml b/schema/tables/filevault_users.yml index d0850922845..755d0f75329 100644 --- a/schema/tables/filevault_users.yml +++ b/schema/tables/filevault_users.yml @@ -1,5 +1,5 @@ name: filevault_users -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Information on the users able to unlock the current boot volume if protected with FileVault. platforms: - darwin diff --git a/schema/tables/find_cmd.yml b/schema/tables/find_cmd.yml index 18df5bc4224..456dd7546c6 100644 --- a/schema/tables/find_cmd.yml +++ b/schema/tables/find_cmd.yml @@ -23,7 +23,5 @@ columns: required: false description: | Contains the found paths. -notes: | - This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. - Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/firmware_eficheck_integrity_check.yml b/schema/tables/firmware_eficheck_integrity_check.yml index 913eb3dd991..d4271c98c1f 100644 --- a/schema/tables/firmware_eficheck_integrity_check.yml +++ b/schema/tables/firmware_eficheck_integrity_check.yml @@ -15,5 +15,5 @@ columns: description: | Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command. This value is only valid when chip is "intel-t1". -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/google_chrome_profiles.yml b/schema/tables/google_chrome_profiles.yml index 1775ad9eb5e..7d21c36e378 100644 --- a/schema/tables/google_chrome_profiles.yml +++ b/schema/tables/google_chrome_profiles.yml @@ -1,5 +1,5 @@ name: google_chrome_profiles -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Profiles configured in Google Chrome. platforms: - darwin diff --git a/schema/tables/icloud_private_relay.yml b/schema/tables/icloud_private_relay.yml index e6f3f86d0ba..cd80553e10e 100644 --- a/schema/tables/icloud_private_relay.yml +++ b/schema/tables/icloud_private_relay.yml @@ -7,5 +7,5 @@ columns: type: integer required: false description: whether iCloud Private Relay is on or off. 1 is on. 0 is off. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/macadmins_unified_log.yml b/schema/tables/macadmins_unified_log.yml index bd8c6a85af0..b77a52c0f15 100644 --- a/schema/tables/macadmins_unified_log.yml +++ b/schema/tables/macadmins_unified_log.yml @@ -1,5 +1,5 @@ name: macadmins_unified_log -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Allows querying macOS [unified logs](https://developer.apple.com/documentation/os/logging). platforms: - darwin diff --git a/schema/tables/macos_profiles.yml b/schema/tables/macos_profiles.yml index 782b63f3877..18836ed229f 100644 --- a/schema/tables/macos_profiles.yml +++ b/schema/tables/macos_profiles.yml @@ -1,5 +1,5 @@ name: macos_profiles -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: High level information on installed profiles enrollment. platforms: - darwin diff --git a/schema/tables/macos_rsr.yml b/schema/tables/macos_rsr.yml index 3bbe177f629..3338b6749d2 100644 --- a/schema/tables/macos_rsr.yml +++ b/schema/tables/macos_rsr.yml @@ -1,5 +1,5 @@ name: macos_rsr -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Returns information about installed Rapid Security Responses (RSRs). platforms: - darwin diff --git a/schema/tables/mdm.yml b/schema/tables/mdm.yml index abf9c153915..a8a26b1f2a4 100644 --- a/schema/tables/mdm.yml +++ b/schema/tables/mdm.yml @@ -1,5 +1,8 @@ name: mdm -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).

Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not. +notes: + - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [Kolide](https://github.com/kolide/launcher). + - Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not. description: Information on the device's MDM enrollment. platforms: - darwin diff --git a/schema/tables/mdm_bridge.yml b/schema/tables/mdm_bridge.yml index 3656d7fba95..a247ae37e93 100644 --- a/schema/tables/mdm_bridge.yml +++ b/schema/tables/mdm_bridge.yml @@ -23,5 +23,5 @@ columns: type: text required: false description: The full raw output of the MDM command execution. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/munki_info.yml b/schema/tables/munki_info.yml index 7c95b8d28ef..6af50ae6759 100644 --- a/schema/tables/munki_info.yml +++ b/schema/tables/munki_info.yml @@ -1,5 +1,7 @@ name: munki_info -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). +notes: + - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). description: Information from the last [Munki](https://github.com/munki/munki) run. platforms: - darwin diff --git a/schema/tables/munki_installs.yml b/schema/tables/munki_installs.yml index 3f05dfc3fd4..20dc586b51d 100644 --- a/schema/tables/munki_installs.yml +++ b/schema/tables/munki_installs.yml @@ -1,5 +1,7 @@ name: munki_installs -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). +notes: + - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). description: Software packages and other items [Munki](https://github.com/munki/munki) is managing. platforms: - darwin diff --git a/schema/tables/nvram_info.yml b/schema/tables/nvram_info.yml index 4ff3896f03a..96acb36cb02 100644 --- a/schema/tables/nvram_info.yml +++ b/schema/tables/nvram_info.yml @@ -9,5 +9,5 @@ columns: description: | Apple Mobile File Integrity (AMFI) was first released in macOS 10.12. The daemon and service block attempts to run unsigned code. AMFI uses lanchd, code signatures, certificates, entitlements, and provisioning profiles to create a filtered entitlement dictionary for an app. AMFI is the macOS kernel module that enforces code-signing and library validation. Note: AMFI cannot be disabled with SIP enabled, but a change attempt can be made that will appear successful, and report incorrectly as successful. If the AMFI audit fails, and the SIP audit passes, this is still an issue the admin should research. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/orbit_info.yml b/schema/tables/orbit_info.yml index f626eb0c804..5fa64bbd8a9 100644 --- a/schema/tables/orbit_info.yml +++ b/schema/tables/orbit_info.yml @@ -37,5 +37,5 @@ columns: type: bigint required: false description: Uptime of the orbit process in seconds. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/parse_ini.yml b/schema/tables/parse_ini.yml index 3d33596f39b..e5f2719af7e 100644 --- a/schema/tables/parse_ini.yml +++ b/schema/tables/parse_ini.yml @@ -1,5 +1,5 @@ name: parse_ini -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Parse a file as INI configuration. platforms: - darwin diff --git a/schema/tables/parse_json.yml b/schema/tables/parse_json.yml index 7a0e9a339ad..fd1e62c526a 100644 --- a/schema/tables/parse_json.yml +++ b/schema/tables/parse_json.yml @@ -1,5 +1,5 @@ name: parse_json -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Parses an entire file as JSON. See `parse_jsonl` where multiple JSON documents are supported. platforms: - darwin diff --git a/schema/tables/parse_jsonl.yml b/schema/tables/parse_jsonl.yml index 7aae0eef65e..c2664437f73 100644 --- a/schema/tables/parse_jsonl.yml +++ b/schema/tables/parse_jsonl.yml @@ -1,5 +1,5 @@ name: parse_jsonl -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Parses each line of a file as a separate JSON document. See `parse_json` to treat an entire file as a single JSON document. platforms: - darwin diff --git a/schema/tables/parse_xml.yml b/schema/tables/parse_xml.yml index 21b3fe2a40e..6f8ea316582 100644 --- a/schema/tables/parse_xml.yml +++ b/schema/tables/parse_xml.yml @@ -1,5 +1,5 @@ name: parse_xml -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Parses a file as an XML document. platforms: - darwin diff --git a/schema/tables/pmset.yml b/schema/tables/pmset.yml index 2f79b6325d2..e65779f26c2 100644 --- a/schema/tables/pmset.yml +++ b/schema/tables/pmset.yml @@ -11,7 +11,5 @@ columns: type: text required: false description: Result of the command in JSON format. -notes: | - This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. - Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/puppet_info.yml b/schema/tables/puppet_info.yml index 4e704fc4f4e..81a22390b8b 100644 --- a/schema/tables/puppet_info.yml +++ b/schema/tables/puppet_info.yml @@ -1,5 +1,5 @@ name: puppet_info -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Information on the last [Puppet](https://puppet.com/) run. This table uses data from the `last_run_report` that Puppet creates. platforms: - darwin diff --git a/schema/tables/puppet_logs.yml b/schema/tables/puppet_logs.yml index 9b84f426e7e..2600f215394 100644 --- a/schema/tables/puppet_logs.yml +++ b/schema/tables/puppet_logs.yml @@ -1,5 +1,5 @@ name: puppet_logs -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: Outputs [Puppet](https://puppet.com/) logs from the last run. platforms: - darwin diff --git a/schema/tables/puppet_state.yml b/schema/tables/puppet_state.yml index ad8db96d8d6..55bf80ff34d 100644 --- a/schema/tables/puppet_state.yml +++ b/schema/tables/puppet_state.yml @@ -1,5 +1,5 @@ name: puppet_state -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). description: State of every resource [Puppet](https://puppet.com/) is managing. This table uses data from the `last_run_report` that Puppet creates. platforms: - darwin diff --git a/schema/tables/pwd_policy.yml b/schema/tables/pwd_policy.yml index eb34fe8f254..0b4c7770721 100644 --- a/schema/tables/pwd_policy.yml +++ b/schema/tables/pwd_policy.yml @@ -28,7 +28,5 @@ columns: required: false description: | This parameter indicates the minimum number of mixed characters in a password. -notes: | - This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. - Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/sntp_request.yml b/schema/tables/sntp_request.yml index 2af437103be..3a1b9acbd1f 100644 --- a/schema/tables/sntp_request.yml +++ b/schema/tables/sntp_request.yml @@ -17,7 +17,5 @@ columns: type: bigint required: false description: Offset between the host's time and the SNTP time in milliseconds. -notes: | - This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. - Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/software_update.yml b/schema/tables/software_update.yml index fa732e0c1d7..6ba914ff1a3 100644 --- a/schema/tables/software_update.yml +++ b/schema/tables/software_update.yml @@ -8,5 +8,5 @@ columns: required: false description: | If true, means one of the Apple softwares installed on this machine has a new available upgrade. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/sudo_info.yml b/schema/tables/sudo_info.yml index 074c2f5850a..8ae828a5156 100644 --- a/schema/tables/sudo_info.yml +++ b/schema/tables/sudo_info.yml @@ -7,5 +7,5 @@ columns: type: text required: false description: A JSON document with the key value pairs parsed from `sudo -V` output. -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false diff --git a/schema/tables/user_login_settings.yml b/schema/tables/user_login_settings.yml index cf3e0b1a036..02aaa35ec82 100644 --- a/schema/tables/user_login_settings.yml +++ b/schema/tables/user_login_settings.yml @@ -7,5 +7,5 @@ columns: type: integer required: false description: whether password hint is enabled for any user. 1 means one or more users has a password hint set, 0 means no user has a password hint set -notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). evented: false From 541326279db70e17af9e13074e62917ea9b7bd9c Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 17:23:32 -0500 Subject: [PATCH 04/21] Update deploy-on-render.md --- docs/Deploy/deploy-on-render.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Deploy/deploy-on-render.md b/docs/Deploy/deploy-on-render.md index 017227238d4..50bbe685fba 100644 --- a/docs/Deploy/deploy-on-render.md +++ b/docs/Deploy/deploy-on-render.md @@ -105,7 +105,7 @@ Fleet is up and running, head to your public URL. You should be prompted with a setup page, where you can enter your name, email, and password. Run through those steps and you should have an empty hosts page waiting for you. -You’ll find the enroll-secret after clicking “Add hosts”. This is a special secret the host will need to register to your Fleet instance. Once you have the enroll-secret you can use `fleetctl` to generate installers, which makes installing and updating osquery super simple. +You’ll find the enroll-secret after clicking “Add hosts”. This is a special secret the host will need to register to your Fleet instance. Once you have the enroll-secret you can use `fleetctl` to generate Fleet's agent (fleetd), which makes installing and updating osquery super simple. To install `fleetctl`, which is the command line interface (CLI) used to communicate between your computer and Fleet, you either run `npm install -g fleetctl` or [download fleetctl](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.3.0) from Github. Once it's installed try the following command (Docker require) on your terminal: From 17869f67f149d298ea1190229de889cc69799e4c Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 17:23:34 -0500 Subject: [PATCH 05/21] Update rest-api.md --- docs/REST API/rest-api.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 2faa9ff6332..75c811f3da4 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -3243,7 +3243,7 @@ This report includes a subset of host vitals, and simplified policy and vulnerab Currently supports Windows and MacOS. On MacOS this requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/get-started/anatomy#fleetd). Retrieves a host's MDM enrollment status and MDM server URL. @@ -3280,7 +3280,7 @@ If the host exists but is not enrolled to an MDM server, then this API returns ` Currently supports Windows and MacOS. On MacOS this requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/get-started/anatomy#fleetd). Retrieves MDM enrollment summary. Windows servers are excluded from the aggregated data. @@ -3387,7 +3387,7 @@ Retrieves a host's MDM enrollment status, MDM server URL, and Munki version. Requires the [macadmins osquery extension](https://github.com/macadmins/osquery-extension) which comes bundled -in [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +in [Fleet's agent (fleetd)](https://fleetdm.com/docs/get-started/anatomy#fleetd). Currently supported only on macOS. From ec5a1cd54151d9d8dc30e079eebbcf52d8e42abf Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 17:46:22 -0500 Subject: [PATCH 06/21] Update enroll-hosts.md --- docs/Using Fleet/enroll-hosts.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/Using Fleet/enroll-hosts.md b/docs/Using Fleet/enroll-hosts.md index 67c984a13b9..d3df0959189 100644 --- a/docs/Using Fleet/enroll-hosts.md +++ b/docs/Using Fleet/enroll-hosts.md @@ -14,9 +14,9 @@ Fleet supports the [latest version of osquery](https://github.com/osquery/osquer > You must have `fleetctl` installed. [Learn how to install `fleetctl`](https://fleetdm.com/fleetctl-preview). -The `fleetctl package` command is used to generate a fleetd installer. +The `fleetctl package` command is used to generate Fleet's agent (fleetd). -The `--type` flag is used to specify installer type: +The `--type` flag is used to specify the fleetd installer type: - macOS: .pkg - Windows: .msi - Linux: .deb or .rpm @@ -25,7 +25,7 @@ A `--fleet-url` (Fleet instance URL) and `--enroll-secret` (Fleet enrollment sec #### Example -Generate macOS installer (.pkg) +Generate fleetd on macOS (.pkg) ```json fleetctl package --type pkg --fleet-url=example.fleetinstance.com --enroll-secret=85O6XRG8'!l~P&zWt_'f&$QK(sM8_D4x @@ -35,28 +35,28 @@ Tip: To see all options for `fleetctl package` command, run `fleetctl package -h ## UI -To generate an installer in Fleet UI: +To generate Fleet's agent (fleetd) in Fleet UI: 1. Go to the **Hosts** page, and select **Add hosts**. 2. Select the tab for your desired platform (e.g. macOS). 3. A CLI command with all necessary flags will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed. -### Generate installer to enroll host to a specific team +### Enroll host to a specific team With hosts segmented into teams, you can apply unique queries and give users access to only the hosts in specific teams. [Learn more about teams](https://fleetdm.com/docs/using-fleet/segment-hosts). -To generate an installer that enrolls to a specific team: from the **Hosts** page, select the desired team from the menu at the top of the screen, then follow the instructions above for generating an installer. The team's enroll secret will be included in the generated command. +To enroll to a specific team: from the **Hosts** page, select the desired team from the menu at the top of the screen, then follow the instructions above for generating Fleet's agent (fleetd). The team's enroll secret will be included in the generated command. ### Enroll multiple hosts If you're managing an enterprise environment with multiple hosts, you likely have an enterprise deployment tool like [Munki](https://www.munki.org/munki/), [Jamf Pro](https://www.jamf.com/products/jamf-pro/), [Chef](https://www.chef.io/), [Ansible](https://www.ansible.com/), or [Puppet](https://puppet.com/) to deliver software to your hosts. -You can use your software management tool of choice to distribute a fleetd installer generated via the instructions above. +You can use your software management tool of choice to distribute Fleet's agent (fleetd) generated via the instructions above. ### Fleet Desktop [Fleet Desktop](./Fleet-desktop.md) is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine. -You can include Fleet Desktop in the fleetd installer by including `--fleet-desktop` in the `fleetctl package` command. +You can include Fleet Desktop in Fleet's agent (fleetd) by including `--fleet-desktop` in the `fleetctl package` command. ## Enroll Chromebooks @@ -131,7 +131,7 @@ How to unenroll a host from Fleet: - [Testing osquery queries locally](#testing-osquery-queries-locally) - [Finding fleetd logs](#finding-fleetd-logs) - [Using system keystore for enroll secret](#using-system-keystore-for-enroll-secret) -- [Generating Windows installers using local WiX toolset](#generating-windows-installers-using-local-wix-toolset) +- [Generating fleetd for Windows using local WiX toolset](#generating-fleetd-for-windows-using-local-wix-toolset) - [Experimental features](#experimental-features) ### fleetd components @@ -322,11 +322,11 @@ System keystore access can be disabled via `--disable-keystore` flag for the `fl >**Note:** The keychain is not used on macOS when the enroll secret is provided via MDM profile. Keychain support when passing the enroll secret via MDM profile is coming soon. -### Generating Windows installers using local WiX toolset +### Generating fleetd for Windows using local WiX toolset `Applies only to Fleet Premium` -When creating a fleetd installer for Windows hosts (**.msi**) on a Windows or macOS machine, you can tell `fleetctl package` to +When generating Fleet's agent (fleetd) for Windows hosts (**.msi**) on a Windows or macOS machine, you can tell `fleetctl package` to use local installations of the 3 WiX v3 binaries used by this command (`heat.exe`, `candle.exe`, and `light.exe`) instead of those in a pre-configured container, which is the default behavior. To do so: @@ -359,5 +359,5 @@ Applying the environmental variable `"FLEETD_SILENCE_ENROLL_ERROR"=1` on a host This variable is read at launch and will require a restart of the Orbit service if it is not set before installing `fleetd` v1.15.1. - + From 7f65c9a392104df9d6a2c01bcd705dc412ffaf9b Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 17:49:32 -0500 Subject: [PATCH 07/21] Update fleetctl-CLI.md --- docs/Using Fleet/fleetctl-CLI.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Using Fleet/fleetctl-CLI.md b/docs/Using Fleet/fleetctl-CLI.md index 2d6fbca79be..4c12425bf57 100644 --- a/docs/Using Fleet/fleetctl-CLI.md +++ b/docs/Using Fleet/fleetctl-CLI.md @@ -30,7 +30,7 @@ npm install -g fleetctl@latest ### Available commands -Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate installers for Fleet's agent (fleetd) to add new hosts, get information about existing hosts, and more! +Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate Fleet's agent (fleetd) to add new hosts, get information about existing hosts, and more! To see the available commands you can run: @@ -219,5 +219,5 @@ This will generate a `tar.gz` file with: - Files containing database-specific information. - + From 8fc1e9708d84bf9755bb96a9b5a942a90acac2b0 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Wed, 10 Apr 2024 17:51:45 -0500 Subject: [PATCH 08/21] Update update-agents.md --- docs/Using Fleet/update-agents.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Using Fleet/update-agents.md b/docs/Using Fleet/update-agents.md index 78e0d0e40c7..93b61c0052c 100644 --- a/docs/Using Fleet/update-agents.md +++ b/docs/Using Fleet/update-agents.md @@ -132,13 +132,13 @@ This output is _not sensitive_ and will be shared in agent deployments to verify ### Packaging with fleetd -See the [Enroll hosts docs](https://fleetdm.com/docs/using-fleet/enroll-hosts) for instructions on generating the fleetd agent. - -You can use `fleetctl package` to generate installer packages of Fleet's agent (fleetd) to integrate with your Fleet instance. +You can use `fleetctl package` to generate Fleet's agent (fleetd) to integrate with your Fleet instance. For example running `fleetctl package --type deb --fleet-url= --enroll-secret=` will build a `.deb` installer with everything needed to communicate with your fleet instance. +See the [Enroll hosts docs](https://fleetdm.com/docs/using-fleet/enroll-hosts) for instructions on generating the fleetd agent. + ### Key rotation Key rotation is supported for each of the update role keys via the `fleetctl updates rotate` command. From 35660de5a1e06e14fe325e6fcc99b6741c43f307 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 18:18:32 -0500 Subject: [PATCH 09/21] Update enroll-hosts.md --- docs/Using Fleet/enroll-hosts.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/Using Fleet/enroll-hosts.md b/docs/Using Fleet/enroll-hosts.md index d3df0959189..6cfc5453397 100644 --- a/docs/Using Fleet/enroll-hosts.md +++ b/docs/Using Fleet/enroll-hosts.md @@ -124,7 +124,7 @@ How to unenroll a host from Fleet: ## Advanced - [Fleet agent (fleetd) components](#fleetd-components) -- [Signing fleetd installer](#signing-fleetd-installer) +- [Signing fleetd](#signing-fleetd) - [Grant full disk access to osquery on macOS](#grant-full-disk-access-to-osquery-on-macos) - [Using mTLS](#using-mtls) - [Specifying update channels](#specifying-update-channels) @@ -153,11 +153,11 @@ graph LR; orbit -- "Auto Update (TLS)" --> tuf; ``` -### Signing fleetd installers +### Signing fleetd - >**Note:** Currently, the `fleetctl package` command does not support signing Windows fleetd installers. Windows installers can be signed after building. + >**Note:** Currently, the `fleetctl package` command does not support signing Windows fleetd. Windows fleetd can be signed after building. -The `fleetctl package` command supports signing and notarizing macOS osquery installers via the +The `fleetctl package` command supports signing and notarizing macOS fleetd via the `--sign-identity` and `--notarize` flags. Check out the example below: @@ -166,7 +166,7 @@ Check out the example below: AC_USERNAME=appleid@example.com AC_PASSWORD=app-specific-password fleetctl package --type pkg --sign-identity=[PATH TO SIGN IDENTITY] --notarize --fleet-url=[YOUR FLEET URL] --enroll-secret=[YOUR ENROLLMENT SECRET] ``` -The above command must be run on a macOS device, as the notarizing and signing of macOS fleetd installers can only be done on macOS devices. +The above command must be run on a macOS device, as the notarizing and signing of macOS fleetd can only be done on macOS devices. Also, remember to replace both `AC_USERNAME` and `AC_PASSWORD` environment variables with your Apple ID and a valid [app-specific](https://support.apple.com/en-ca/HT204397) password, respectively. Some organizations (notably those with Apple Enterprise Developer Accounts) may also need to specify `AC_TEAM_ID`. This value can be found on the [Apple Developer "Membership" page](https://developer.apple.com/account/#!/membership) under "Team ID." From a3b1ee250374420187ed8c5934bee76087b6bb83 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:23:08 -0500 Subject: [PATCH 10/21] Update fleet-server-configuration.md --- docs/Configuration/fleet-server-configuration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 4cf230f59c8..4e5b038e512 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -897,7 +897,7 @@ This flag can be used to control load on the database in scenarios in which many ##### osquery_label_update_interval -The interval at which Fleet will ask osquery agents to update their results for label queries. +The interval at which Fleet will ask Fleet's agent (fleetd) to update results for label queries. Setting this to a higher value can reduce baseline load on the Fleet server in larger deployments. @@ -915,7 +915,7 @@ Valid time units are `s`, `m`, `h`. ##### osquery_policy_update_interval -The interval at which Fleet will ask osquery agents to update their results for policy queries. +The interval at which Fleet will ask Fleet's agent (fleetd) to update results for policy queries. Setting this to a higher value can reduce baseline load on the Fleet server in larger deployments. @@ -933,7 +933,7 @@ Valid time units are `s`, `m`, `h`. ##### osquery_detail_update_interval -The interval at which Fleet will ask osquery agents to update host details (such as uptime, hostname, network interfaces, etc.) +The interval at which Fleet will ask Fleet's agent (fleetd) to update host details (such as uptime, hostname, network interfaces, etc.) Setting this to a higher value can reduce baseline load on the Fleet server in larger deployments. From 9ac233664ddc28c73e307207985dddc421643aa2 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:23:11 -0500 Subject: [PATCH 11/21] Update File-carving.md --- docs/Contributing/File-carving.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Contributing/File-carving.md b/docs/Contributing/File-carving.md index ca14a295ea1..57b743f2071 100644 --- a/docs/Contributing/File-carving.md +++ b/docs/Contributing/File-carving.md @@ -1,12 +1,12 @@ ## File carving -Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from osquery agents, returning the full contents to Fleet. +Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from Fleet's agent (fleetd) returning the full contents to Fleet. File carving data can be either stored in Fleet's database or to an external S3 bucket. For information on how to configure the latter, consult the [configuration docs](https://fleetdm.com/docs/deploying/configuration#s-3-file-carving-backend). ### Configuration -Given a working flagfile for connecting osquery agents to Fleet, add the following flags to enable carving: +Given a working flagfile for connecting fleetd to Fleet, add the following flags to enable carving: ```sh --disable_carver=false @@ -16,7 +16,7 @@ Given a working flagfile for connecting osquery agents to Fleet, add the followi --carver_block_size=8000000 ``` -The default flagfile provided in the "Add New Host" dialog also includes this configuration. +The default flagfile provided in the "Add new host" dialog also includes this configuration. #### Carver block size From b5fc99a457efc47a04cd308e70fbc2b7316f3913 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:23:58 -0500 Subject: [PATCH 12/21] Update public-ip.md --- docs/Deploy/public-ip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Deploy/public-ip.md b/docs/Deploy/public-ip.md index 4d108a6ad9b..65837f7405c 100644 --- a/docs/Deploy/public-ip.md +++ b/docs/Deploy/public-ip.md @@ -1,6 +1,6 @@ # Public IPs of devices -Fleet attempts to deduce the public IP of devices from well-known HTTP headers received on requests made by the osquery agent. +Fleet attempts to deduce the public IP of devices from well-known HTTP headers received on requests made by Fleet's agent (fleetd). The HTTP request headers are checked in the following order: 1. If `True-Client-IP` header is set, then Fleet will extract its value. From 3bede70a66d27d6a4f072151b3ea8b9d30f0ecb4 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:25:06 -0500 Subject: [PATCH 13/21] Update anatomy.md --- docs/Get started/anatomy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Get started/anatomy.md b/docs/Get started/anatomy.md index 6c6e6b96acb..8e64e0a38cb 100644 --- a/docs/Get started/anatomy.md +++ b/docs/Get started/anatomy.md @@ -23,7 +23,7 @@ Fleet Desktop is a menu bar icon that gives end users visibility into the securi The Fleetd Chrome Extension enrolls ChromeOS devices in Fleet. [Docs](https://github.com/fleetdm/fleet/blob/main/ee/fleetd-chrome/README.md). ## Host -A host is a computer, server, or other endpoint. Fleet gathers information from an osquery agent installed on each of your hosts. [Docs](https://fleetdm.com/docs/using-fleet/adding-hosts). +A host is a computer, server, or other endpoint. Fleet gathers information from Fleet's agent (fleetd) installed on each of your hosts. [Docs](https://fleetdm.com/docs/using-fleet/adding-hosts). ## Team A team is a group of hosts. Use teams to segment your hosts into groups that reflect your organization's IT and security policies. [Docs](https://fleetdm.com/docs/using-fleet/teams). From fc0688c021cf48348a8d0c9ce4b5758dae680f57 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:26:13 -0500 Subject: [PATCH 14/21] Update FAQ.md --- docs/Get started/FAQ.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/Get started/FAQ.md b/docs/Get started/FAQ.md index fbb3452a931..8a4d5c2185a 100644 --- a/docs/Get started/FAQ.md +++ b/docs/Get started/FAQ.md @@ -14,7 +14,7 @@ Fleet provides a standard [Terraform module](https://fleetdm.com/docs/deploy/dep You can enroll servers and laptops using a simple installer or automatically deliver Fleet's agent (fleetd) using your existing tools, such as Chef, Terraform, Munki/autopkg, Ansible, Puppet, Jamf, Intune, etc. -By default, Fleet keeps agents up to date automatically. For self-managed instances, Fleet provides a [migration runner](https://fleetdm.com/docs/deploy/upgrading-fleet#upgrading-fleet). +By default, Fleet keeps fleetd up to date automatically. For self-managed instances, Fleet provides a [migration runner](https://fleetdm.com/docs/deploy/upgrading-fleet#upgrading-fleet). ## What options do I have for access control? What about auditing admin activity? @@ -106,8 +106,8 @@ Anyone is free to contribute to the free or paid features of the project. We are The only way we are able to partner as a business to provide support and build new open source and paid features is through customers purchasing Fleet Premium. -## How can I uninstall the osquery agent? -To uninstall the osquery agent, follow the below instructions for your operating system. +## How can I uninstall fleetd? +To uninstall Fleet's agent (fleetd), follow the below instructions for your operating system. #### MacOS Run the Orbit [cleanup script](https://github.com/fleetdm/fleet/blob/main/orbit/tools/cleanup/cleanup_macos.sh) From 738e00192e010a195f9582348eb1f68548822d56 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:26:44 -0500 Subject: [PATCH 15/21] Update rest-api.md --- docs/REST API/rest-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 75c811f3da4..794da9cef7a 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -628,7 +628,7 @@ for pagination. For a comprehensive list of activity types and detailed informat - [Get carve](#get-carve) - [Get carve block](#get-carve-block) -Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from osquery agents, returning the full contents to Fleet. +Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from Fleet's agent (fleetd), returning the full contents to Fleet. To initiate a file carve using the Fleet API, you can use the [live query](#run-live-query) endpoint to run a query against the `carves` table. From f7ac3001346249bb7a0e45ac3431246fb0616107 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:27:12 -0500 Subject: [PATCH 16/21] Update Learn-how-to-use-Fleet.md --- docs/Using Fleet/Learn-how-to-use-Fleet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Using Fleet/Learn-how-to-use-Fleet.md b/docs/Using Fleet/Learn-how-to-use-Fleet.md index 1f14eb23c31..fceea3f7db9 100644 --- a/docs/Using Fleet/Learn-how-to-use-Fleet.md +++ b/docs/Using Fleet/Learn-how-to-use-Fleet.md @@ -43,7 +43,7 @@ To run this query on your device: 3. Type the query you would like to run, `SELECT * FROM os_version;`. 4. Select **Run query**, then select **All hosts** (your device may be the only host added to Fleet), and finally select **Run** to execute the query. -The query may take several seconds to complete, because Fleet has to wait for the osquery agents to respond with results. Only online hosts will respond with results to a live query. +The query may take several seconds to complete, because Fleet has to wait for the Fleet's agent (fleetd) to respond with results. Only online hosts will respond with results to a live query. > Fleet's query response time is inherently variable because of osquery's heartbeat response time. This helps prevent performance issues on hosts. From 9e76f2739456b2ed85ef7225d25688818c6f8c82 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 11 Apr 2024 19:27:55 -0500 Subject: [PATCH 17/21] Update Supported-host-operating-systems.md --- docs/Using Fleet/Supported-host-operating-systems.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Using Fleet/Supported-host-operating-systems.md b/docs/Using Fleet/Supported-host-operating-systems.md index 9733f9751f6..ce1567877e2 100644 --- a/docs/Using Fleet/Supported-host-operating-systems.md +++ b/docs/Using Fleet/Supported-host-operating-systems.md @@ -32,5 +32,5 @@ If you aren't sure what version of `glibc` your distribution is using, [DistroWa > The `fleetctl package` command is not supported on DISA-STIG distribution. - + From 629f45664484fe449307ceb67d837884f06a8bef Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 12 Apr 2024 12:27:46 -0500 Subject: [PATCH 18/21] Fix markdown formatting on mdm.yml --- schema/tables/mdm.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/schema/tables/mdm.yml b/schema/tables/mdm.yml index a8a26b1f2a4..a63e09b13c9 100644 --- a/schema/tables/mdm.yml +++ b/schema/tables/mdm.yml @@ -1,7 +1,9 @@ name: mdm -notes: +notes: >- - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [Kolide](https://github.com/kolide/launcher). + - Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not. description: Information on the device's MDM enrollment. platforms: From 5d12773d152cab7aad299986632a406542020b7a Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 12 Apr 2024 12:28:50 -0500 Subject: [PATCH 19/21] Update munki_info.yml --- schema/tables/munki_info.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema/tables/munki_info.yml b/schema/tables/munki_info.yml index 6af50ae6759..b837daa4d7d 100644 --- a/schema/tables/munki_info.yml +++ b/schema/tables/munki_info.yml @@ -1,6 +1,7 @@ name: munki_info -notes: +notes: >- - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). description: Information from the last [Munki](https://github.com/munki/munki) run. platforms: From 546451f002a5dcea4aa93fc8b469411b2a1b9ea2 Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 12 Apr 2024 12:31:12 -0500 Subject: [PATCH 20/21] Update munki_installs.yml --- schema/tables/munki_installs.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema/tables/munki_installs.yml b/schema/tables/munki_installs.yml index 20dc586b51d..dfa49b68442 100644 --- a/schema/tables/munki_installs.yml +++ b/schema/tables/munki_installs.yml @@ -1,6 +1,7 @@ name: munki_installs -notes: +notes: >- - This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). + - Code based on work by [macadmins/osquery-extension](https://github.com/macadmins/osquery-extension) and [Kolide](https://github.com/kolide/launcher). description: Software packages and other items [Munki](https://github.com/munki/munki) is managing. platforms: From db32cc6a5be76f4c7b6c424322d4f0b185cf5605 Mon Sep 17 00:00:00 2001 From: Rachael Shaw Date: Thu, 25 Apr 2024 10:39:52 -0500 Subject: [PATCH 21/21] Update agent-configuration.md --- docs/Configuration/agent-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index fc13e3aa621..41569959ee2 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -25,7 +25,7 @@ If you are not using the latest version of osquery, you can create a config YAML fleetctl apply --force -f config.yaml ``` -You can verify that your agent options are valid by using [the fleetctl apply command](https://fleetdm.com/docs/using-fleet/fleetctl-cli#fleetctl-apply) with the `--dry-run` flag. This will report any error and do nothing if the configuration was valid. If you don't use the latest version of osquery, you can override validation using the `--force` flag. This will update agent options even if they are invalid. +You can verify that your agent options are valid by using [the `fleetctl apply` command](https://fleetdm.com/docs/using-fleet/fleetctl-cli) with the `--dry-run` flag. This will report any error and do nothing if the configuration was valid. If you don't use the latest version of osquery, you can override validation using the `--force` flag. This will update agent options even if they are invalid. Existing options will be overwritten by the application of this file.