diff --git a/articles/delivering-data-to-snowflake-from-fleet-and-osquery.md b/articles/delivering-data-to-snowflake-from-fleet-and-osquery.md index 2164f7da49..447cc05a0d 100644 --- a/articles/delivering-data-to-snowflake-from-fleet-and-osquery.md +++ b/articles/delivering-data-to-snowflake-from-fleet-and-osquery.md @@ -32,7 +32,7 @@ MDM typically collects data every 24 hours in most MDM applications out of the b ## What is Fleet? -Fleet is a centralized management and orchestration tool for osquery. It allows tech professionals to centralize queries, query packs, and configurations and handles secure communications from the endpoints to the service. Fleet also provides a set of tools to manage the infrastructure and the osquery installers for each platform. There are many osquery solutions out there that do similar things, but Fleet was attractive to us because they focused solely on getting the data and managing the queries and configurations. Which is what our initial goal was in this proof-of-concept exercise. Fleet has a channel on the [Mac Admins Slack](https://osquery.slack.com/join/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw#/) you can join if you are interested in learning more. Additional noteworthy features are (but are not limited to) SAML integration for your IdP, support, RBAC for teams, and they are looking to add vulnerability data to their product as well. They also display the osquery table schema in the web application for quick reference, which is a nice quality of life feature. +Fleet is a centralized management and orchestration tool for osquery. It allows tech professionals to centralize queries and configurations and handles secure communications from the endpoints to the service. Fleet also provides a set of tools to manage the infrastructure and the osquery installers for each platform. There are many osquery solutions out there that do similar things, but Fleet was attractive to us because they focused solely on getting the data and managing the queries and configurations. Which is what our initial goal was in this proof-of-concept exercise. Fleet has a channel on the [Mac Admins Slack](https://osquery.slack.com/join/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw#/) you can join if you are interested in learning more. Additional noteworthy features are (but are not limited to) SAML integration for your IdP, support, RBAC for teams, and they are looking to add vulnerability data to their product as well. They also display the osquery table schema in the web application for quick reference, which is a nice quality of life feature. The two features I want to focus on for this blog post are the live queries and the scheduled queries. Live queries are probably what you would assume they are. It is a feature where you can run a query from the Fleet application and get near-real-time results back from an endpoint (or many endpoints) very quickly. Scheduled queries run at a set increment of time, and those query results can be streamed from the application to cloud storage. diff --git a/articles/from-osquery-to-fleet-planting-the-seed.md b/articles/from-osquery-to-fleet-planting-the-seed.md index ebed8ec006..f52bf15162 100644 --- a/articles/from-osquery-to-fleet-planting-the-seed.md +++ b/articles/from-osquery-to-fleet-planting-the-seed.md @@ -11,7 +11,8 @@ As osquery usage increased within companies, so did the demand for an open sourc We started off building Fleet to solve the most common problems companies face when adopting osquery for endpoint visibility: - Creating and managing a central osquery server requires build and maintenance time. Fleet is that central management server. -- Figuring out what queries you need to ask a question is time-consuming. Fleet makes this easy through an accessible UI and query packs. +- Figuring out what queries you need to ask a question is time-consuming. Fleet makes this easy + through an accessible UI and standard query library. - Installing osquery across your entire device fleet can be challenging. Fleet provides a simple command-line tool for installing the osquery agent without battling certs and config settings. Today 1.65 million devices are managed by Fleet from companies like Uber, Gusto, Schrodinger, and Dropbox, and we’re just getting started. diff --git a/articles/import-and-export-queries-and-packs-in-fleet.md b/articles/import-and-export-queries-and-packs-in-fleet.md deleted file mode 100644 index 5ed748ac0f..0000000000 --- a/articles/import-and-export-queries-and-packs-in-fleet.md +++ /dev/null @@ -1,45 +0,0 @@ -# Import and export queries and packs in Fleet - -![Import and export queries and packs in Fleet](../website/assets/images/articles/import-and-export-queries-and-packs-in-fleet-cover-700x343@2x.png) - -When managing multiple Fleet environments, you may want to move queries and/or packs from one environment to the other. Or, when inspired by a set of packs shared by a member of the osquery community, you might want to import these packs into your Fleet instance. To do this, you need to have access to a Unix shell and a basic knowledge of the [fleetctl CLI tool](https://www.npmjs.com/package/fleetctl). - -Below are two example scenarios. For leaner instructions on how to move queries and packs from one Fleet environment to another, [check out Fleet’s documentation](https://github.com/fleetdm/fleet/blob/00ea74ed800568f063c6d5553f113dbd1e55a09c/docs/1-Using-Fleet/configuration-files/README.md#moving-queries-and-packs-from-one-fleet-environment-to-another). - -### Example scenario 1: Moving packs, and their queries, from one Fleet environment to another - -Let’s say you manage your organization’s staging and production servers. In order to keep your production servers speedy, you’ve set up two separate Fleet instances for the two environments: Staging and Production. - -With this separation, you can diligently test your queries in Staging without negatively impacting the performance of servers in Production. - -On Friday, after test results come in, you want to move all performant packs, and their queries, from Staging to Production. You know you can open up the Fleet UI for Production and create the packs manually, but each pack has at least 4 new queries. These packs already exist in Staging so you don’t need to spend time recreating each one in Production. - -Here’s how you can quickly export and import the packs in 3 quick fleetctl commands: - -1. Navigate to `~/.fleet/config` to find the context names for your “exporter” and “importer” environment. For the purpose of these instructions, we use the context names `staging` and `production` respectively. - -2. Run the command `fleetctl get queries --yaml --context staging > queries.yml && fleetctl apply -f queries.yml --context production`. This will import all the queries from your Staging Fleet instance into your Production Fleet instance. *Note, this will also write a list of all queries in yaml syntax to a file names `queries.yml`.* - -3. Run the command `fleetctl get packs --yaml --context staging > packs.yml && fleetctl apply -f packs.yml --context production`. This will import all the packs from your Staging Fleet instance into your Production Fleet instance. *Note, this will also write a list of all packs in yaml syntax to a file names `packs.yml`.* - -*Note, when importing packs, you must always first import all the queries (step 2) that these packs contain.* - -### Example scenario 2: Importing community packs into Fleet - -You just found [a collection of awesome queries and packs for Fleet](https://github.com/palantir/osquery-configuration/tree/master/Fleet) and you want to import them into your *Staging Fleet* environment. - -Here’s how you can do this in 2 quick fleetctl commands. - -1. Create a new file, `awesome-packs.yml` and paste in the desired packs and queries in the [correct Fleet configuration format](https://github.com/fleetdm/fleet/tree/main/docs/1-Using-Fleet/configuration-files#using-yaml-files-in-fleet). -2. Run the command `fleetctl apply -f awesome-packs.yml`. - -### Could this post be more helpful? - -Let us know if you can think of any other example scenarios you’d like us to cover. - - - - - - - diff --git a/articles/import-and-export-queries-in-fleet.md b/articles/import-and-export-queries-in-fleet.md new file mode 100644 index 0000000000..7d8423441c --- /dev/null +++ b/articles/import-and-export-queries-in-fleet.md @@ -0,0 +1,49 @@ +# Import and export queries in Fleet + +![Import and export queries in Fleet](../website/assets/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png) + +When managing multiple Fleet instances, you may want to move queries from one instance to another. Or, when inspired by queries shared by a member of the osquery community, you might want to import these queries into your Fleet instance. To do this, you need to have access to a Unix shell and the [fleetctl CLI tool](https://fleetdm.com/fleetctl-preview). + +Below are two example scenarios. + +### Example scenario 1: Moving queries from one Fleet instance to another + +Let’s say you use Fleet at work and you also have a Fleet instance in your lab at home. You were testing some queries at home and you want to share these queries with your team at work. + +How to export and import queries: + +1. In your home lab, run the `fleetctl login` command to log in to Fleet. + +2. Run the following command to export your queries into a `queries.yml` file: + +`fleetctl get queries --yaml > queries.yml` + +> `queries.yml` will be created in your current working directory. + +3. Upload your `queries.yml` file to GitHub so that you can download this file onto your work computer. + +4. At work, with `queries.yml` downloaded in your current working directory, run the following + command to import your queries: + +`fleetctl apply -f queries.yml` + +### Example scenario 2: Importing community queries into Fleet + +You just found [a collection of awesome queries for Fleet](https://github.com/palantir/osquery-configuration/tree/master/Fleet) and you want to import +them into your Fleet instance. + +How to import queries: + +1. Create a new file, `palantir-queries.yml`, and paste in the desired queries in the [correct Fleet configuration format](https://fleetdm.com/docs/using-fleet/configuration-files#using-yaml-files-in-fleet). +2. Run the command `fleetctl apply -f awesome-queries.yml`. + +### Could this post be more helpful? + +Let us know if you can think of any other example scenarios you’d like us to cover. + + + + + + + diff --git a/docs/Using-Fleet/configuration-files/README.md b/docs/Using-Fleet/configuration-files/README.md index f6694cd523..f29c3de8a3 100644 --- a/docs/Using-Fleet/configuration-files/README.md +++ b/docs/Using-Fleet/configuration-files/README.md @@ -113,15 +113,7 @@ spec: The `targets` field allows you to specify the `labels` field. With the `labels` field, the hosts that become members of the specified labels, upon enrolling to Fleet, will automatically become targets of the given pack. -### Moving queries and packs from one Fleet environment to another - -When managing multiple Fleet environments, you may want to move queries and/or packs from one "exporter" environment to a another "importer" environment. - -1. Navigate to `~/.fleet/config` to find the context names for your "exporter" and "importer" environment. For the purpose of these instructions we will use the context names `exporter` and `importer` respectively. -2. Run the command `fleetctl get queries --yaml --context exporter > queries.yaml && fleetctl apply -f queries.yml --context importer`. This will import all the queries from your exporter Fleet instance into your importer Fleet instance. _Note, this will also write a list of all queries in yaml syntax to a file names `queries.yml`._ -3. Run the command `fleetctl get packs --yaml --context exporter > packs.yaml && fleetctl apply -f packs.yml --context importer`. This will import all the packs from your exporter Fleet instance into your importer Fleet instance. _Note, this will also write a list of all packs in yaml syntax to a file names `packs.yml`._ - -## Labels +### Labels The following file describes the labels which hosts should be automatically grouped into. The label resource should include the actual SQL query so that the label is self-contained: diff --git a/website/assets/images/articles/import-and-export-queries-and-packs-in-fleet-cover-700x343@2x.png b/website/assets/images/articles/import-and-export-queries-and-packs-in-fleet-cover-700x343@2x.png deleted file mode 100644 index 19e49da9a3..0000000000 Binary files a/website/assets/images/articles/import-and-export-queries-and-packs-in-fleet-cover-700x343@2x.png and /dev/null differ diff --git a/website/assets/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png b/website/assets/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png new file mode 100644 index 0000000000..ba60092562 Binary files /dev/null and b/website/assets/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png differ diff --git a/website/config/routes.js b/website/config/routes.js index 58fad81752..34827bad45 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -214,6 +214,7 @@ module.exports.routes = { 'GET /use-cases/generate-process-trees-with-osquery': '/guides/generate-process-trees-with-osquery', 'GET /use-cases/get-and-stay-compliant-across-your-devices-with-fleet': '/securing/get-and-stay-compliant-across-your-devices-with-fleet', 'GET /use-cases/import-and-export-queries-and-packs-in-fleet': '/guides/import-and-export-queries-and-packs-in-fleet', + 'GET /guides/import-and-export-queries-and-packs-in-fleet': '/guides/import-and-export-queries-in-fleet', 'GET /use-cases/locate-assets-with-osquery': '/guides/locate-assets-with-osquery', 'GET /use-cases/osquery-a-tool-to-easily-ask-questions-about-operating-systems': '/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems', 'GET /use-cases/osquery-consider-joining-against-the-users-table': '/guides/osquery-consider-joining-against-the-users-table',