Jetbrains override query by mostlikelee · Pull Request #39800 · fleetdm/fleet

mostlikelee · 2026-02-12T21:46:36Z

Related issue: Resolves #26405

Checklist for submitter

Found on disk metadata to use that conforms to the desired version scheme of Jetbrains products.

If some of the following don't apply, delete the relevant line.

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.
Added/updated automated tests
QA'd all new/changed functionality manually

codecov · 2026-02-12T22:21:50Z

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.27%. Comparing base (1b2a699) to head (269eea6).
⚠️ Report is 82 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/osquery_utils/queries.go	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #39800      +/-   ##
==========================================
+ Coverage   66.26%   66.27%   +0.01%     
==========================================
  Files        2438     2439       +1     
  Lines      195263   195404     +141     
  Branches     8538     8538              
==========================================
+ Hits       129384   129511     +127     
+ Misses      54165    54158       -7     
- Partials    11714    11735      +21

Flag	Coverage Δ
backend	`68.07% <0.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ksykulev

Not saying this is the incorrect approach. But would it be possible to use MutateSoftwareOnIngestion?

I know we did some munging of EAP versions: #22723
We also did some grabbing of release notes for versions on mac office:
#30082 (can't grab jetbrains website/docs on every software ingest)

I haven't specifically looked at how the mapping works for jetbrains versions. I assume the reason for the additional query is because a static hardcoded list would be out of the question, and the maintenance would be a nightmare?

ksykulev · 2026-02-16T19:12:44Z

server/service/osquery_utils/queries.go

+`,
+		Platforms:        []string{"windows"},
+		DirectIngestFunc: directIngestSoftware,
+		Discovery:        discoveryTable("programs"),


I see in the description it says Requires fleetd". I assume this is in reference to file_contents which is a fleetd extension table. Should we add it as one of the tables in Discovery?

When we added macos_codesign and macos_executable_sha256 we added the fleetd extension tables as part of the Discovery query. I believe this is because some users might have old versions of orbit after the server is upgraded so it could case breakages (I can't remember the exact mechanism here).

great catch! i updated the discovery query to use the file_contents table

ksykulev · 2026-02-16T19:42:16Z

docs/Contributing/product-groups/orchestration/understanding-host-vitals.md

+		END
+
+		WHERE p.publisher LIKE '%JetBrains%'
+		AND p.name NOT LIKE '%Toolbox%'


query looks good though! 👍

kilo-code-bot · 2026-02-17T12:45:09Z

docs/Contributing/product-groups/orchestration/understanding-host-vitals.md

+
+- Discovery query:
+```sql
+SELECT 1 FROM osquery_registry WHERE active = true AND registry = 'table' AND name = 'programs'


WARNING: Discovery query mismatch with the actual code

I noticed this documentation says the discovery query checks for the programs table, but the actual code at queries.go uses discoveryTable("file_contents"), which checks for the file_contents table instead. Since file_contents is the fleetd-specific table that might not be available, that's the one that really needs to be discovered. The programs table is always present on Windows.

It would be wonderful if we could update this to match what the code actually does:

Suggested change

SELECT 1 FROM osquery_registry WHERE active = true AND registry = 'table' AND name = 'programs'

SELECT 1 FROM osquery_registry WHERE active = true AND registry = 'table' AND name = 'file_contents'

kilo-code-bot · 2026-02-17T12:45:09Z

server/service/osquery_utils/queries.go

+	// windows_jetbrains uses the version contained in the product-info.json file as exe installers
+	// provide an unconvertible build number in the programs table not used in vulnerability matching.
+	"windows_jetbrains": {
+		Description: "A software override query[^1] to append 'JetBrains' to the name of JetBrains Toolbox-managed applications on Windows. Requires `fleetd`",


SUGGESTION: Description doesn't match what the query does

The description says "to append 'JetBrains' to the name," but the query doesn't actually append anything to the name — it selects p.name AS name unchanged. The real purpose, as your helpful comment above explains, is to fix the version number by reading from product-info.json. It might be nice to update the description so it reflects what the query truly does — something like "A software override query to use the correct version from product-info.json for JetBrains Toolbox-managed applications on Windows."

This same description also appears in the docs file, so both would want updating together.

kilo-code-bot · 2026-02-17T12:45:23Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Well, I've taken a careful look through this PR, and I'm happy to say it all looks quite thoughtful and well-done. The new JetBrains software override query correctly selects the same columns expected by the Windows software ingestion pipeline, the COALESCE fallback to p.version is a nice safety net, and the LEFT JOIN ensures hosts without a product-info.json still report their software. The SoftwareOverrideMatch function properly mirrors the SQL WHERE clause logic, and both test files have been updated to account for the new query. The documentation is clear and matches the implementation.

Files Reviewed (4 files)

changes/26405-jetbrains - Changelog entry
docs/Contributing/product-groups/orchestration/understanding-host-vitals.md - Documentation for new query
server/service/osquery_utils/queries.go - New JetBrains software override query
server/service/osquery_test.go - Discovery test updated
server/service/osquery_utils/queries_test.go - Detail queries test updated

mostlikelee · 2026-02-17T12:50:25Z

Not saying this is the incorrect approach. But would it be possible to use MutateSoftwareOnIngestion?

Ian and I both looked at a mutation approach, but unfortunately couldn't find a reliable approach

I know we did some munging of EAP versions: #22723 We also did some grabbing of release notes for versions on mac office: #30082 (can't grab jetbrains website/docs on every software ingest)

I chatted with Sharon on the release notes approach, but ultimately decided it was overkill for this case (only affects exe installers on windows)

I haven't specifically looked at how the mapping works for jetbrains versions. I assume the reason for the additional query is because a static hardcoded list would be out of the question, and the maintenance would be a nightmare?

that's the thought, hoping this approach will be maintenance free

mostlikelee · 2026-02-17T14:59:08Z

@getvictor need a codeowner approval here for host vitals docs

sharon-fdm

I only reviewed
docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
LGTM.

Relying on existing approval for the rest.

This reverts commit a3bafe8.

mostlikelee added 2 commits February 12, 2026 14:31

add override query

e38990d

changelog

806a170

mostlikelee requested a review from a team as a code owner February 12, 2026 21:46

mostlikelee temporarily deployed to Docker Hub February 12, 2026 21:46 — with GitHub Actions Inactive

mostlikelee assigned ksykulev Feb 12, 2026

docs, testfix

80b8cfb

mostlikelee requested review from sgress454 and sharon-fdm as code owners February 12, 2026 22:03

mostlikelee temporarily deployed to Docker Hub February 12, 2026 22:03 — with GitHub Actions Inactive

test fix

f5f1e7b

mostlikelee temporarily deployed to Docker Hub February 12, 2026 22:21 — with GitHub Actions Inactive

ksykulev reviewed Feb 16, 2026

View reviewed changes

update discovery query

304d4b6

mostlikelee temporarily deployed to Docker Hub February 17, 2026 12:42 — with GitHub Actions Inactive

kilo-code-bot bot reviewed Feb 17, 2026

View reviewed changes

mostlikelee added 2 commits February 17, 2026 05:54

correct description

c9d3924

make doc

269eea6

mostlikelee had a problem deploying to Docker Hub February 17, 2026 12:55 — with GitHub Actions Error

mostlikelee temporarily deployed to Docker Hub February 17, 2026 12:56 — with GitHub Actions Inactive

ksykulev approved these changes Feb 17, 2026

View reviewed changes

sharon-fdm approved these changes Feb 17, 2026

View reviewed changes

mostlikelee merged commit a3bafe8 into main Feb 17, 2026
50 checks passed

mostlikelee deleted the 26405-jetbrains branch February 17, 2026 15:00

mostlikelee added a commit that referenced this pull request Mar 4, 2026

Revert "Jetbrains override query (#39800)"

5004f02

This reverts commit a3bafe8.

mostlikelee mentioned this pull request Mar 4, 2026

Fix Jetbrains versions - Take 2 #40928

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Jetbrains override query#39800

Jetbrains override query#39800
mostlikelee merged 7 commits intomainfrom
26405-jetbrains

mostlikelee commented Feb 12, 2026

Uh oh!

codecov bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

ksykulev left a comment

Uh oh!

ksykulev Feb 16, 2026

Uh oh!

mostlikelee Feb 17, 2026

Uh oh!

ksykulev Feb 16, 2026

Uh oh!

kilo-code-bot bot Feb 17, 2026

Uh oh!

kilo-code-bot bot Feb 17, 2026

Uh oh!

kilo-code-bot bot commented Feb 17, 2026 •

edited

Loading

Uh oh!

mostlikelee commented Feb 17, 2026

Uh oh!

mostlikelee commented Feb 17, 2026

Uh oh!

sharon-fdm left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	SELECT 1 FROM osquery_registry WHERE active = true AND registry = 'table' AND name = 'programs'
	SELECT 1 FROM osquery_registry WHERE active = true AND registry = 'table' AND name = 'file_contents'

Conversation

mostlikelee commented Feb 12, 2026

Checklist for submitter

Uh oh!

codecov bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ksykulev left a comment

Choose a reason for hiding this comment

Uh oh!

ksykulev Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

mostlikelee Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

ksykulev Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Uh oh!

mostlikelee commented Feb 17, 2026

Uh oh!

mostlikelee commented Feb 17, 2026

Uh oh!

sharon-fdm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Feb 12, 2026 •

edited

Loading

kilo-code-bot bot commented Feb 17, 2026 •

edited

Loading