Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 52

Add release notes for #7766 (#14497)

Browse source 
I'm not sure this is the best place to put this information or if this
is the best format. But we need to inform users of these changes
somewhere in the v4.39.0 release notes. Am all ears.

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
This commit is contained in:
Lucas Manuel Rodriguez 2023-10-13 14:58:24 -03:00 committed by GitHub
parent defd64d806
commit 138d66cfcb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
changes/13489-implement-api-changes
View file

@ -1,2 +0,0 @@
* Add `GET /api/_version_/fleet/queries/{id}/report` API endpoint to retrieve the stored results of a given query.
* Add `discard_data` field to API query endpoints.

8
changes/7766-release-notes Normal file
View file

@ -0,0 +1,8 @@
* Fleet now stores results of scheduled queries:
- Fleet will store up to 1000 results for each scheduled query.
NOTE: If the number of results for a scheduled query is below 1000, then the results will continuously get updated every time the hosts send results to Fleet.
- A new `server_settings.query_reports_disabled` field was added to the global configuration to disable this feature.
- A new API endpoint was added to get the stored results of a query: `GET /api/_version_/fleet/queries/{id}/report`.
- A new field `discard_data` has been added to API queries endpoints to allow disabling reports for a query (default `false`). If using yaml files to apply queries, you will need to explicitly add `discard_data: true` to disable storing results in Fleet for scheduled queries.
- Queries with `discard_data` set to `false` will be scheduled to run on hosts, even if `automations_enabled` is set to `false`, and their results will be processed and stored in Fleet. Because of this change, Fleet now does more validation on osquery result logs that are ingested and will error on unknown message formats.