Website: update article image filenames to match website naming conventions (#32263)
Related to: [#25943](https://github.com/fleetdm/fleet/issues/25943) Changes: - Updated filenames of images in the website/assets/images/articles/ folder to match website naming conventions - Updated links to images in articles.
Eric
GitHub
|
|
@ -23,12 +23,12 @@ SELECT 1 FROM apps WHERE bundle_identifier = 'com.adobe.Reader' AND version_comp
|
|||
|
||||
3. **Open the software install automation modal**: In the **Policies** tab, click the **Manage automations** button on the top-right, then select **Install software** from the context menu that pops up.
|
||||
|
||||
|
||||
|
||||
|
||||
4. **Select policy**: Click the checkbox next to your newly created policy's name. To the right of it select from the
|
||||
drop-down list the software you would like to be installed upon failure of this policy.
|
||||
|
||||
|
||||
|
||||
|
||||
When a host fails the selected policy, this will trigger the software to be installed on the host.
|
||||
|
||||
|
|
@ -42,7 +42,7 @@ If the software install fails, you can reset a software automation and trigger t
|
|||
* The policy check mechanism runs on a typical one-hour cadence on all online hosts.
|
||||
* Fleet will send install requests to the hosts on the first policy failure (first "No" result for the host) or if a policy goes from "Yes" to "No". Currently, Fleet will not send an install request if a policy is already failing and continues to fail ("No" -> "No"). See the following flowchart for details.
|
||||
|
||||
|
||||
|
||||
*Detailed flowchart*
|
||||
|
||||
App Store (VPP) apps won't be installed if a host has MDM turned off or if you run out of licenses (purchased in Apple Business Manager). Currently, these errors aren't surfaced in Fleet. After turning MDM on for a host or purchasing more licenses, you can retry [installing the app on the host's **Host details** page](https://fleetdm.com/guides/deploy-software-packages#install-the-package). To retry on multiple hosts at once, head to **Policies > Manage Automations** in Fleet and turn the app's policy automation off and back on.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide
|
||||
|
||||
|
||||
|
||||
|
||||
## Background
|
||||
|
||||
|
|
@ -94,5 +94,5 @@ Hopefully, this article sparked your interest in the Fleet REST API and potentia
|
|||
<meta name="authorGitHubUsername" value="dherder">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2023-05-22">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly@2x.jpg">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly-800x450@2x.jpg">
|
||||
<meta name="description" value="Step-by-step guide on building a dynamic dashboard with Fleet's REST API, Flask, and Plotly. Master data visualization with open-source tools!">
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ failed profiles to affected hosts.
|
|||
- **Pending**: the profile is pending install on the host
|
||||
- **Failed**: the profile failed to be installed on the host
|
||||
|
||||
|
||||
|
||||
|
||||
3. To resend a profile to all hosts where instialltion failed
|
||||
- Hover over the **Failed** status row.
|
||||
|
|
|
|||
|
|
@ -130,7 +130,7 @@ When saving the configuration, Fleet will attempt to connect to the SCEP server
|
|||
|
||||
When Fleet delivers the profile to your hosts, Fleet will replace the variables. If something goes wrong, errors will appear on each host's **Host details > OS settings**.
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example configuration profile
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
Deploying Windows configurations profiles (aka Configuration Service Providers (CSPs)) for Windows devices can feel daunting, especially if you're new to the process or accustomed to ClickOps and other UI-driven approaches. The scarcity of straightforward documentation and guides can make it feel like you're venturing into a configuration rabbit hole.
|
||||
|
||||
|
||||
|
||||
|
||||
This guide will help you understand the building blocks to crafting CSPs of varying complexity – from simple payloads to more complex ones that involve modification of ADMX underpinnings.
|
||||
|
||||
|
|
@ -29,12 +29,12 @@ Windows maps the name and category path of a Group Policy to an MDM policy by pa
|
|||
|
||||
Unfortunately, to capture handling of ADMX the admin building the policies must use a UI, such as the Group Policy Editor, to gather the necessary data. For this example, we will use the ```WindowsPowerShell``` which controls PowerShell settings and is an ADMX-backed policy. [This](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowspowershell) is the official documentation that we will work from if you want to follow along. Notice this banner that indicates the ADMX requirement:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
In the Windows documentation, you will notice a section called ADMX Mapping:
|
||||
|
||||
|
||||
|
||||
|
||||
Pay attention to the line **ADMX File Name**, which will show you the name of the .admx file you need to open to help craft your CSP. All ADMX files are located at:
|
||||
```C:\Windows\PolicyDefinitions\{ADMXFileName.admx}```
|
||||
|
|
@ -66,7 +66,7 @@ Values can take one of the following types:
|
|||
At this point in the build we know the ADMX keys for this specific policy, which values those keys accept, and now to translate that into a CSP that Fleet can interpret.
|
||||
You can also see in the group policy editor the values that are being modified by the profile.
|
||||
|
||||
|
||||
|
||||
|
||||
In this example, we will modify the ExecutionPolicy value, which in group policy editor translates to “Turn on Script Execution”, the XML from the .admx looks like such:
|
||||
|
||||
|
|
@ -222,7 +222,7 @@ Applications and Service Logs > Microsoft > Windows > DeviceManagement-Enterpris
|
|||
|
||||
The `Admin` logs will show you all profiles that have been pushed to the device and their status. It helps to use the `Find` function to look for keywords in your profile to narrow your search. Here is an example of the logs that show when the CSP we created here was deployed.
|
||||
|
||||
|
||||
|
||||
|
||||
Alternatively, you can use this PowerShell one-liner to see errors from the MDM event log:
|
||||
|
||||
|
|
|
|||
|
|
@ -130,17 +130,17 @@ Uploading the profile to a team in Fleet will automatically deliver it to all ma
|
|||
## End user experience
|
||||
When the Company Portal app and Platform SSO configuration profile are deployed to a host, the end user will receive a notification that says **Registration Required: Please register with your identity provider**. You should direct your end users to interact with this notification by clicking the **Register** button that appears when they hover their mouse over the notification.
|
||||
|
||||
|
||||
|
||||
|
||||
After clicking the register button in the notification, a Platform Single Sign-On Registration window will appear. After clicking **Continue**, the user will be prompted for the password they use to log into their Mac (this might be different than their Entra ID password).
|
||||
|
||||
|
||||
|
||||
|
||||
Next, they’ll be prompted to sign into Microsoft Entra ID. This is what associates the user’s device to their Microsoft Entra ID account.
|
||||
|
||||
Lastly, they’ll be prompted to enable the Company Portal app to be used as a Passkey. The notification will direct them to System Settings and enable the toggle next to the Company Portal app.
|
||||
|
||||
|
||||
|
||||
|
||||
Once registration is complete, the next time an employee logs into an Entra ID protected app in their web browser, the authentication will be seamless. The employee won’t be prompted for their password or be required to complete an MFA challenge. The Platform SSO extension will handle the entire authentication using the Secure Enclave-backed key.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Deploying SentinelOne with Fleet
|
||||
|
||||
|
||||
|
||||
|
||||
SentinelOne is a cybersecurity platform that provides endpoint protection, detection, and response capabilities to organizations. It uses artificial intelligence and machine learning to detect and prevent various types of cyber threats, including malware, ransomware, and zero-day exploits. It's a common toolset deployed by system admins through Fleet. This guide covers off deployment through macOS and Windows.
|
||||
|
||||
|
|
@ -110,4 +110,4 @@ Want to learn more? Reach out directly to me or the [team at Fleet](https://flee
|
|||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2025-04-15">
|
||||
<meta name="description" value="Deploying SentinelOne with Fleet">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/installing-sentinel-one-with-fleet-1600x900.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/installing-sentinel-one-with-fleet-1600x900@2x.png">
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Embracing the future: Declarative Device Management
|
||||
|
||||
|
||||
|
||||
|
||||
As a Mac administrator, managing a fleet of Apple devices across your organization requires consistency and airtight security. With a variety of system services and background tasks to oversee, the challenge is not only to maintain uniform configurations but also to keep the organization's data secure. Recognizing these challenges, Apple has advanced a powerful new approach - Declarative Device Management (DDM).
|
||||
|
||||
|
|
@ -61,5 +61,5 @@ Fleet is transforming how we manage and secure devices. Offering an open-core, c
|
|||
<meta name="authorFullName" value="JD Strong">
|
||||
<meta name="publishedOn" value="2023-07-06">
|
||||
<meta name="articleTitle" value="Embracing the future: Declarative Device Management">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/embracing-the-future-declarative-device-management@2x.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/embracing-the-future-declarative-device-management-800x450@2x.png">
|
||||
<meta name="description" value="Explore the transformative impact of Declarative Device Management (DDM), Fleet, and osquery for MacAdmins.">
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Account-driven User Enrollment for personal Apple devices (BYOD)
|
||||
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ The steps to configure Fleet as "Compliance partner" for macOS devices can be fo
|
|||
|
||||
After this is done, the "Fleet partner" will be shown with a "Pending activation" status.
|
||||
|
||||
|
||||
|
||||
|
||||
### "All Company" Intune group requirement
|
||||
|
||||
|
|
@ -27,7 +27,7 @@ To connect Fleet to your Entra account you need your "Microsoft Entra tenant ID"
|
|||
|
||||
Once you have your tenant ID, go to Fleet: `Settings` > `Integrations` > `Conditional access` and enter the tenant ID.
|
||||
|
||||
|
||||
|
||||
|
||||
After clicking `Save` you will be redirected to https://login.microsoftonline.com to consent to the permissions for Fleet's multi-tenant application.
|
||||
After consenting you will be redirected back to Fleet (to `/settings/integrations/conditional-access`).
|
||||
|
|
@ -46,7 +46,7 @@ The Company Portal macOS application can be downloaded from https://go.microsoft
|
|||
|
||||
To configure automatic installation on your macOS devices you go to `Software` > `Select the team` > `Add software` > `Custom package`. Upload the `CompanyPortal-Installer.pkg` and check the `Automatic install` option.
|
||||
|
||||
|
||||
|
||||
|
||||
You should also configure "Company Portal" as a software package to deploy during "Setup Experience" for DEP/ABM devices.
|
||||
Go to `Controls` > `Setup experience` > `Install software` > `Add software`, select `Company Portal` for macOS and hit `Save`.
|
||||
|
|
@ -160,7 +160,7 @@ Once Fleet policies are configured you also need to configure Entra ID "Conditio
|
|||
[Building a Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies) outlines the steps to create such policies on Entra ID.
|
||||
|
||||
For instance, you can create a policy to "block access to Office 365 on macOS devices reported as non-compliant by Fleet":
|
||||
|
||||
|
||||
|
||||
Make sure to assign Entra users/groups to the created "Conditional Access" policies.
|
||||
|
||||
|
|
@ -177,11 +177,11 @@ Once disabled, hosts will not be reporting compliance status to Entra anymore.
|
|||
|
||||
After the Platform SSO profile is deployed to end-user devices, users will see a notification and will perform the authentication flow with Entra ID.
|
||||
|
||||
|
||||
|
||||
|
||||
After following the authentication steps, the user might hit the following message if it attempts to log in to a Microsoft services/apps right away after authenticating via Platform SSO (Fleet can take up to one hour to gather the information and send it to Intune):
|
||||
|
||||
|
||||
|
||||
|
||||
On that scenario, after hitting "Continue" the user will be redirected to https://fleetdm.com/microsoft-compliance-partner/enroll which will advise to click on the Fleet tray icon "My device" > "🔄 Refetch". The refetch will synchronize data to Intune and the user will be able to log in to Microsoft services/apps without entering credentials.
|
||||
|
||||
|
|
@ -190,10 +190,10 @@ On that scenario, after hitting "Continue" the user will be redirected to https:
|
|||
When a Fleet policy configured for conditional access starts failing on a host, then the user will be logged out and blocked from logging in to Entra ID.
|
||||
|
||||
E.g. here's "Microsoft Teams" message on a blocked host:
|
||||
|
||||
|
||||
|
||||
And here's the error message when trying to re-login:
|
||||
|
||||
|
||||
|
||||
Clicking on "Check Compliance" redirects the user to https://fleetdm.com/microsoft-compliance-partner/remediate.
|
||||
The user will be able to log in again once the failing policies are remediated.
|
||||
|
|
|
|||
|
|
@ -15,12 +15,12 @@ With EscrowBuddy, the generation and escrowing of FileVault recovery keys happen
|
|||
## How do I set up EscrowBuddy with Fleet?
|
||||
To escrow FileVault recovery keys in Fleet, the only thing admins need to do is enable disk encryption on the teams for which disk encryption is required. To do this, in the Fleet UI, select your desired team and navigate to **Controls > OS settings > Disk encryption** then check the box next to **Turn on disk encryption**.
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet will send a configuration profile to all macOS hosts on that team to enable disk encryption and silently deploy EscrowBuddy.
|
||||
|
||||
When the disk encryption profile is delivered to a host, but a key is not yet escrowed, Fleet will show the profile as Action required (pending). The next time the user logs in to their Mac, EscrowBuddy generates a new recovery key on the host and Fleet will collect it.
|
||||
|
||||
|
||||
|
||||
## What’s going on behind the scenes?
|
||||
Behind the scenes, EscrowBuddy runs as a [macOS authorization plugin](https://developer.apple.com/documentation/security/authorization-plug-ins). It works in conjunction with the FileVault profile that Fleet deploys to hosts to enforce disk encryption.
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ Fleet Desktop is currently in beta. Check out the remaining work to bring Fleet
|
|||
## Scope transparency with Fleet Desktop on macOS, Windows, and Linux
|
||||
**Available in Fleet Free & Fleet Premium**
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet Desktop also allows end-users to see what information about their laptop or workstation, is accessible to their organization.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ Fleet Desktop uses a random UUID to authenticate to the Fleet server. While it's
|
|||
## Show your end users a call to action in Fleet Desktop for failing policies
|
||||
**Available in Fleet Free & Fleet Premium**
|
||||
|
||||
|
||||
|
||||
The main goal of Fleet Desktop is to empower end users to take charge of managing the security of their enrolled device. If a device is failing a policy check, Fleet Desktop will now show end users useful information for resolving the issue and make it easy to check if they've fixed it.
|
||||
|
||||
## More new features, improvements, and bug fixes
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ Fleet will now automatically create a user account when a new user attempts to l
|
|||
## See remaining disk space for all hosts
|
||||
**Available in Fleet Free and Fleet Premium**
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet 4.19.0 adds the ability to quickly see which hosts may not have enough remaining disk space to install operating system updates.
|
||||
|
||||
|
|
@ -34,7 +34,7 @@ Fleet 4.19.0 adds the ability to see a list of all Windows operating system (OS)
|
|||
|
||||
Also, Windows operating system versions now include the display version like "21H" or "21H2." This allows you to quickly reference [endoflife.date/windows](https://endoflife.date/windows), so you can see which operating systems Microsoft no longer supports.
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet 4.19.0 also adds the improved Windows operating system versions on the **Hosts** page and **Host details** page in the Fleet UI, as well as the `GET /hosts` and `GET /hosts/{id}` API routes.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Fleet 4.20.0 | Aggregate Munki issues, test features on canary teams, improved macOS vulnerability detection
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet 4.20.0 is up and running. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.20.0) or continue reading to get the highlights.
|
||||
|
||||
|
|
@ -14,7 +14,7 @@ For update instructions, see our [upgrade guide](https://fleetdm.com/docs/deploy
|
|||
## Aggregate Munki issues
|
||||
**Available in Fleet Free and Fleet Premium**
|
||||
|
||||
|
||||
|
||||
|
||||
Fleet 4.20.0 adds the ability to see a list of all Munki warnings and errors (issues) across all your hosts.
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ To see this in action, head to the **Home > macOS** page and view the **Munki**
|
|||
## Test features on canary teams
|
||||
**Available in Fleet Premium**
|
||||
|
||||
|
||||
|
||||
|
||||
You can now test features like software inventory on a subset of your hosts.
|
||||
|
||||
|
|
@ -114,4 +114,4 @@ Visit our [Update guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in
|
|||
<meta name="authorGitHubUsername" value="noahtalerman">
|
||||
<meta name="publishedOn" value="2022-09-09">
|
||||
<meta name="articleTitle" value="Fleet 4.20.0 | Aggregate Munki issues, test features on canary teams, improved macOS vulnerability detection">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.20.0-1600x900.jpg">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.20.0-800x450@2x.jpg">
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ In addition to validating required keys and the type of document values, Fleet m
|
|||
## Manage osquery flags remotely with Orbit
|
||||
**Available in Fleet Free and Fleet Premium**
|
||||
|
||||
|
||||
|
||||
|
||||
Admins used to need a software orchestration tool (e.g., Chef) to deploy new osquery flags to the end user. Now, you can specify new flags in Fleet — and Orbit will restart osquery with the appropriate flags.
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ Fleet 4.27.0 makes it easy to see who tried to log in to Fleet and failed. Our c
|
|||
|
||||
In the UI an account administrator will see the following information:
|
||||
|
||||
|
||||
|
||||
|
||||
If you pair this new login activity with the audit improvements from [release 4.26](https://fleetdm.com/releases/fleet-4.26.0) you can now set up an alert if multiple failed login attempts occur.
|
||||
|
||||
|
|
|
|||
|
|
@ -18,8 +18,8 @@ Starting in version v4.58.0, Fleet supports running scripts to remediate failing
|
|||
Following are screenshots of the end-user experience when Fleet runs the script to install the extension (GNOME requires a prompt for installation of extensions for security purposes).
|
||||
|
||||
<p float="left">
|
||||
<img src="../website/assets/images/fedora_38_appindicator_extension_prompt.png" title="Fedora 38" width="300" />
|
||||
<img src="../website/assets/images/debian_12_appindicator_extension_prompt.png" title="Debian 12" width="300" />
|
||||
<img src="../website/assets/images/articles/fedora_38_appindicator_extension_prompt-326x434@2x.png" title="Fedora 38" width="300" />
|
||||
<img src="../website/assets/images/articles/debian_12_appindicator_extension_prompt-326x434@2x.png" title="Debian 12" width="300" />
|
||||
</p>
|
||||
|
||||
> If the end-user hits `Cancel` instead of `Install` then the extension won't be installed and the policy will continue to fail on the host. Fleet only deploys the script on the first failure of the policy, so the end-user won't be prompted again and again, just once. Admins can still run the script on such hosts manually.
|
||||
|
|
@ -29,8 +29,8 @@ Following are screenshots of the end-user experience when Fleet runs the script
|
|||
After the extension is installed your users will see the Fleet icon on their menu bar:
|
||||
|
||||
<p float="left">
|
||||
<img src="../website/assets/images/fedora_38_fleet_desktop_tray.png" title="Fedora 38" width="300" />
|
||||
<img src="../website/assets/images/debian_12_fleet_desktop_tray.png" title="Debian 12" width="300" />
|
||||
<img src="../website/assets/images/articles/fedora_38_fleet_desktop_tray-159x59@2x.png" title="Fedora 38" width="300" />
|
||||
<img src="../website/assets/images/articles/debian_12_fleet_desktop_tray-159x59@2x.png" title="Debian 12" width="300" />
|
||||
</p>
|
||||
|
||||
<meta name="authorGitHubUsername" value="lucasmrod">
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Fleet takes on Vegas: Exploring cybersecurity's future at Black Hat, B-Sides, and DEF CON 31
|
||||
|
||||
[](https://fleetdm.com/imagine/defcon-31)
|
||||
|
||||
|
||||
Fleet is participating in Black Hat, Security B-Sides, and DEF CON 31 this year in Las Vegas, with representation by two of our key team members: Marcos Oviedo and Zach Wasserman.
|
||||
|
||||
|
|
@ -64,5 +64,5 @@ Fleet is committed to staying on the leading edge of cybersecurity trends and ad
|
|||
<meta name="authorFullName" value="JD Strong">
|
||||
<meta name="publishedOn" value="2023-08-02">
|
||||
<meta name="articleTitle" value="Fleet takes on Vegas: Exploring cybersecurity's future at Black Hat, B-Sides, and DEF CON 31">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-in-vegas-2023@2x.jpg">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-in-vegas-2023-960x540@2x.jpg">
|
||||
<meta name="description" value="Explore cybersecurity's cutting edge with Fleet at three top-tier conferences - Black Hat, Security B-Sides, and DEF CON.">
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ Organizations can deploy configuration profiles, settings, and policies aligned
|
|||
|
||||
Fleet brings the GitOps workflow to your organization’s configuration profiles with a full API and scriptable command line interface (CLI). GitOps is a modern approach to Continuous Deployment (CD) that uses Git as the single source of truth for declarative infrastructure and application configurations and MDM configuration profiles.
|
||||
|
||||
|
||||
|
||||
|
||||
## Programmability and automation make for a better user experience
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Fleet is abuzz 🐝 for MacDevOps:YVR
|
||||
|
||||
[](https://mdoyvr.com/)
|
||||
[](https://mdoyvr.com/)
|
||||
|
||||
_Pun Warning: If puns give you the heebie-jeebies, we apologize. MacDevOps:YVR has a bee 🐝 theme this year, and we frankly couldn't help ourselves. That's all._
|
||||
|
||||
|
|
@ -36,5 +36,5 @@ If you are interested in attending the [MacDevOps:YVR Conference](https://mdoyvr
|
|||
<meta name="authorFullName" value="JD Strong">
|
||||
<meta name="publishedOn" value="2023-06-07">
|
||||
<meta name="articleTitle" value="Fleet is abuzz 🐝 for MacDevOps:YVR">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-is-abuzz-for-macdevops-yvr-2023@2x.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-is-abuzz-for-macdevops-yvr-2023-960x540@2x.png">
|
||||
<meta name="description" value="Fleet is a proud sponsor of MacDevOps:YVR which is back in person in Vancouver, B.C. June 21-22, 2023">
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# Foreign vitals: map IdP users to hosts
|
||||
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
|
|
@ -45,7 +45,7 @@ To map users from Okta to hosts in Fleet, we'll do the following steps:
|
|||
9. Back in Okta, select **Save**.
|
||||
10. Under the **Provisioning** tab, select **To App** and then select **Edit** in the **Provisioning to App** section. Enable **Create Users**, **Update User Attributes**, **Deactivate Users**, and then select **Save**.
|
||||
11. On the same page, make sure that `givenName` and `familyName` have Okta value assigned to it. Currently, Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Fleet also supports the `department` attribute (optional). Delete the rest of the attributes.
|
||||
|
||||
|
||||
|
||||
#### Step 3: Map users and groups to hosts in Fleet
|
||||
|
||||
|
|
@ -53,7 +53,7 @@ To send users and groups information to Fleet, you have to assign them to your n
|
|||
|
||||
1. In OKta's main menu **Directory > Groups** and then select **Add group**. Name it "Fleet human-device mapping".
|
||||
2. On the same page, select the **Rules** tab. Create a rule that will assign users to your "Fleet human-device mapping" group.
|
||||
|
||||
|
||||
3. In the main menu, select **Applications > Applications** and select your new SCIM app. Then, select the **Assignments** tab.
|
||||
4. Select **Assign > Assign to Groups** and then select **Assign** next to the "Fleet human-device mapping" group. Then, select **Done**. Now all users that you assigned to the "Fleet human-device mapping" group will be provisioned to Fleet.
|
||||
5. On the same page, select **Push Groups** tab. Then, select **Push Groups > Find groups by name** and add all groups that you assigned to "Fleet human-device mapping" group previously (make sure that **Push group memberships immediately** is selected). All groups will be provisioned in Fleet, and Fleet will map those groups to users.
|
||||
|
|
@ -86,10 +86,10 @@ To map users from Entra ID to hosts in Fleet, we'll do the following steps:
|
|||
#### Step 3: Map users and groups to hosts in Fleet
|
||||
|
||||
1. From the side menu, select **Attribute mapping** and then select **Provision Microsoft Entra ID Groups**.
|
||||
|
||||
|
||||
2. Select **Provision Microsoft Entra ID Users**.
|
||||
3. Ensure that the attributes `userName`, `givenName`, `familyName`, `department`, `active`, and `externalId` are mapped to **Microsoft Entra ID Attribute**. Currently, Fleet requires the `userName` `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes. Then, elect **Save** and select the close icon in the top right corner.
|
||||
|
||||
|
||||
4. Next, from the side menu, select **Users and groups** , **+ Add user/group**, and **None Selected**.
|
||||
5. Select the users and groups that you want to map to hosts in Fleet and then select **Assign**.
|
||||
6. From the side menu, select **Overview** and select **Start provisioning**.
|
||||
|
|
@ -225,9 +225,9 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
|
|||
7. For the **Bind CN**, enter the username that you saved in the first step. For **Bind Password**, enter the password you saved.
|
||||
8. In **Base DN**, enter your Google Workspace domain in a DN format (e.g. dc=yourcompany,dc=com).
|
||||
9. For the **User Property Mappings,** remove all selected properties by clicking the "X" icon, and select all user properties that we created in the left box and select the ">" icon between boxes.
|
||||
|
||||
|
||||
10. For the **Group Property Mappings**, remove all selected properties by clicking the "X" icon, and select all group properties that we created in the left box and select the ">" icon between boxes.
|
||||
|
||||
|
||||
11. Under **Additional settings**, enter values below:
|
||||
**User object filter** > `(objectClass=person)`, **Group object filter** > `(objectClass= groupOfNames)`, **Group membership field** > `member`, **Object uniqueness field** > `objectSid`
|
||||
13. Select **Finish** to save your configuration.
|
||||
|
|
@ -266,5 +266,5 @@ last name).
|
|||
<meta name="authorFullName" value="Marko Lisica">
|
||||
<meta name="publishedOn" value="2025-04-11">
|
||||
<meta name="articleTitle" value="Foreign vitals: map IdP users to hosts">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/add-users-from-idp-cover-img.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/add-users-from-idp-cover-img-800x400@2x.png">
|
||||
<meta name="category" value="guides">
|
||||
|
|
|
|||
|
|
@ -6,12 +6,12 @@ For example, if a user in the Fleet UI adds a query and then GitOps runs, the qu
|
|||
GitOps mode helps avoid this by preventing the user from saving or editing the query in the first place
|
||||
(though does still allow running an ad-hoc live query):
|
||||
|
||||
|
||||
|
||||
|
||||
## Enabling
|
||||
To turn GitOps mode on or off, navigate to **Settings** > **Integrations** > **Change management**:
|
||||
|
||||
|
||||
|
||||
|
||||
## Still available
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ Workbrew enables companies to maintain the agility developers love while ensurin
|
|||
|
||||
As noted in the article, Workbrew brings a customizable solution to organizations struggling with “[shadow IT](https://techcrunch.com/2015/09/25/its-time-to-embrace-not-fear-shadow-it/)” risks. By offering a fleet dashboard, vulnerability detection, and deep integrations with tools like [Fleet](https://fleetdm.com/device-management), Workbrew helps companies maintain visibility and control over Homebrew deployments at scale. Whether it’s ensuring compliance in regulated industries or automating package installations for remote teams, Workbrew is paving the way for safer, smarter IT management.
|
||||
|
||||
|
||||
|
||||
|
||||
At Fleet, we’re excited to support Workbrew’s efforts. Our [integration](https://fleetdm.com/integrations) ensures that Workbrew users can easily sync device data, enabling seamless management across teams. Workbrew’s approach resonates with our belief in open-source and transparent tools for IT and security.
|
||||
|
||||
|
|
|
|||
|
|
@ -189,7 +189,7 @@ You can configure software installations and a script to be executed during Setu
|
|||
|
||||
If you configure software and/or a script for setup experience, users will see a window like this pop open after their device enrolls in MDM via ADE:
|
||||
|
||||
|
||||
|
||||
|
||||
This window shows the status of the software installations as well as the script exectution. Once all steps have completed, the window can be closed and Setup Assistant will proceed as usual.
|
||||
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ Now that you have the nice .yaml, you can `apply` to your fleet server:
|
|||
fleetctl apply network_connection_listening.yaml
|
||||
```
|
||||
There are a bunch to convert and apply:
|
||||
|
||||
|
||||
|
||||
In the Queries list within fleet, you will now have:
|
||||
|
||||
|
|
|
|||
|
|
@ -55,7 +55,7 @@ Configuration:
|
|||
|
||||
> Available in Fleet Premium
|
||||
|
||||
|
||||
|
||||
|
||||
End user experience:
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ Since the release of Ventura, users can now manage Login Items, LaunchAgents and
|
|||
|
||||
Now in macOS, not only can users see which apps are set up for persistence, they can also control them from a single place in System Settings. Importantly, when apps add a LaunchAgent, LaunchDaemon, or Login Item, the system now displays a banner.
|
||||
|
||||
|
||||
|
||||
|
||||
## Login items in the enterprise
|
||||
|
||||
|
|
@ -16,7 +16,7 @@ While transparency and openness to see what is running on your machine is a [key
|
|||
|
||||
To properly manage these “Login Items”, admins need to use an MDM to deploy a profile with the new `com.apple.servicemanagement` payload. This profile cannot be manually installed and it must be deployed from an MDM to a device.
|
||||
|
||||
|
||||
|
||||
|
||||
## The anatomy of the payload
|
||||
|
||||
|
|
@ -90,7 +90,7 @@ For a complete `.mobileconfig` example, check out [this repo.](https://github.co
|
|||
|
||||
Upload this .mobileconfig to your MDM and once it’s deployed to your endpoints, you will see something like such in the Login Items section of the System Settings:
|
||||
|
||||
|
||||
|
||||
|
||||
And that’s it!
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023
|
||||
|
||||
[](https://mdoyvr.com/)
|
||||
[](https://mdoyvr.com/)
|
||||
|
||||
Hello there, macOS admins! Let's talk about the upcoming PSU MacAdmins Conference 2023 (aka Summer Camp for Mac Admins). PSUMAC is July 18-21 at Penn State University. Hope to see you there.
|
||||
|
||||
|
|
@ -45,5 +45,5 @@ In a nutshell, the [PSU MacAdmins Conference 2023](https://macadmins.psu.edu/) i
|
|||
<meta name="authorFullName" value="JD Strong">
|
||||
<meta name="publishedOn" value="2023-07-13">
|
||||
<meta name="articleTitle" value="Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/psu-macadmins-conference-2023@2x.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/psu-macadmins-conference-2023-1600x900@2x.png">
|
||||
<meta name="description" value="A look ahead to PSU MacAdmin Conference July 18-21, 2023">
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# Software self-service
|
||||
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Using bioutil to verify Touch ID/biometric utilization
|
||||
|
||||
|
||||
|
||||
|
||||
## Intro
|
||||
|
||||
|
|
@ -79,7 +79,7 @@ At this point, we know that the file we want to read, `biometric_config.json` ex
|
|||
|
||||
`SELECT * FROM parse_json WHERE path = '/opt/orbit/biometric_config.json'`
|
||||
|
||||
|
||||
|
||||
|
||||
If you just wanted to return the number of enrolled fingerprints, use a query like such:
|
||||
|
||||
|
|
@ -106,4 +106,4 @@ For more tips and detailed guides, don’t forget to check out the Fleet
|
|||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2024-12-29">
|
||||
<meta name="description" value="Streamline Biometric Security with bioutil and Fleet">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/bioutil@2x.png">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/bioutil-1600x900@2x.png">
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Using Fleet and Okta Workflows to generate a daily OS report
|
||||
|
||||
|
||||
|
||||
|
||||
_Today we wanted to feature [Harrison](https://kitchenstocomputers.com/fleet/), a member of our community. We thought this piece was exceptionally useful and wanted to share it with you all. If you are interested in contributing to the Fleet blog, feel free to [contact us](https://fleetdm.com/company/contact) or reach out to [@jdstrong](https://osquery.slack.com/team/U04MTPBAHQS) on the osquery slack._
|
||||
|
||||
|
|
@ -145,5 +145,5 @@ than a 200, but I have skipped that for now.
|
|||
<meta name="authorGitHubUsername" value="harrisonravazzolo">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2023-05-09">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/using-fleet-and-okta-workflows-to-generate-a-daily-os-report@2x.jpg">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/using-fleet-and-okta-workflows-to-generate-a-daily-os-report-800x450@2x.jpg">
|
||||
<meta name="description" value="Learn how to use Fleet to query device OS information through the Fleet REST API and automate daily Slack notifications using Okta Workflows.">
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Using GitHub Actions to apply configuration profiles with Fleet
|
||||
|
||||
|
||||
|
||||
|
||||
In the ever-evolving realm of software management, automated workflows are an essential tool in maintaining system efficiency and security. At the heart of this drive towards automation is GitHub Actions, a powerful platform that enables developers to automate, customize, and execute software development workflows directly in their repositories. In this blog post, we focus on utilizing GitHub Actions with Fleet to apply the latest configuration profiles from your repository.
|
||||
|
||||
|
|
@ -167,5 +167,5 @@ With this in place, you need to trigger your GitHub action by adding configurati
|
|||
<meta name="authorGitHubUsername" value="spokanemac">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2023-05-31">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/using-github-actions-to-apply-configuration-profiles-with-fleet@2x.jpg">
|
||||
<meta name="articleImageUrl" value="../website/assets/images/articles/using-github-actions-to-apply-configuration-profiles-with-fleet-1600x900@2x.jpg">
|
||||
<meta name="description" value="A guide on using GitHub Actions with Fleet for efficient and automated application of the latest configuration profiles for a GitOps workflow.">
|
||||
|
|
|
|||
|
Before Width: | Height: | Size: 50 KiB After Width: | Height: | Size: 50 KiB |
|
Before Width: | Height: | Size: 33 KiB After Width: | Height: | Size: 33 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 40 KiB |
|
Before Width: | Height: | Size: 84 KiB After Width: | Height: | Size: 84 KiB |
|
Before Width: | Height: | Size: 157 KiB After Width: | Height: | Size: 157 KiB |
|
Before Width: | Height: | Size: 170 KiB After Width: | Height: | Size: 170 KiB |
|
Before Width: | Height: | Size: 169 KiB After Width: | Height: | Size: 169 KiB |
|
Before Width: | Height: | Size: 23 KiB After Width: | Height: | Size: 23 KiB |
|
Before Width: | Height: | Size: 17 KiB After Width: | Height: | Size: 17 KiB |
|
Before Width: | Height: | Size: 18 KiB After Width: | Height: | Size: 18 KiB |
|
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 16 KiB |
|
Before Width: | Height: | Size: 34 KiB After Width: | Height: | Size: 34 KiB |
|
Before Width: | Height: | Size: 23 KiB After Width: | Height: | Size: 23 KiB |
|
Before Width: | Height: | Size: 65 KiB After Width: | Height: | Size: 65 KiB |
|
Before Width: | Height: | Size: 200 KiB After Width: | Height: | Size: 200 KiB |
|
Before Width: | Height: | Size: 66 KiB After Width: | Height: | Size: 66 KiB |
|
Before Width: | Height: | Size: 165 KiB After Width: | Height: | Size: 165 KiB |
|
Before Width: | Height: | Size: 60 KiB After Width: | Height: | Size: 60 KiB |
|
Before Width: | Height: | Size: 336 KiB After Width: | Height: | Size: 336 KiB |
|
Before Width: | Height: | Size: 3.4 KiB After Width: | Height: | Size: 3.4 KiB |
|
Before Width: | Height: | Size: 1.6 MiB After Width: | Height: | Size: 1.6 MiB |
|
Before Width: | Height: | Size: 573 KiB After Width: | Height: | Size: 573 KiB |
|
Before Width: | Height: | Size: 32 KiB After Width: | Height: | Size: 32 KiB |
|
Before Width: | Height: | Size: 76 KiB After Width: | Height: | Size: 76 KiB |
|
Before Width: | Height: | Size: 37 KiB After Width: | Height: | Size: 37 KiB |
|
Before Width: | Height: | Size: 167 KiB After Width: | Height: | Size: 167 KiB |
|
Before Width: | Height: | Size: 150 KiB After Width: | Height: | Size: 150 KiB |
|
Before Width: | Height: | Size: 157 KiB After Width: | Height: | Size: 157 KiB |
|
Before Width: | Height: | Size: 565 KiB After Width: | Height: | Size: 565 KiB |
|
Before Width: | Height: | Size: 47 KiB After Width: | Height: | Size: 47 KiB |
|
Before Width: | Height: | Size: 65 KiB After Width: | Height: | Size: 65 KiB |
|
Before Width: | Height: | Size: 245 KiB After Width: | Height: | Size: 245 KiB |
|
Before Width: | Height: | Size: 70 KiB After Width: | Height: | Size: 70 KiB |
|
Before Width: | Height: | Size: 76 KiB After Width: | Height: | Size: 76 KiB |
|
Before Width: | Height: | Size: 153 KiB After Width: | Height: | Size: 153 KiB |
|
Before Width: | Height: | Size: 606 KiB After Width: | Height: | Size: 606 KiB |
|
Before Width: | Height: | Size: 50 KiB After Width: | Height: | Size: 50 KiB |
|
Before Width: | Height: | Size: 244 KiB After Width: | Height: | Size: 244 KiB |
|
Before Width: | Height: | Size: 3.4 MiB After Width: | Height: | Size: 3.4 MiB |
|
Before Width: | Height: | Size: 980 KiB After Width: | Height: | Size: 980 KiB |
|
Before Width: | Height: | Size: 842 KiB After Width: | Height: | Size: 842 KiB |
|
Before Width: | Height: | Size: 24 KiB After Width: | Height: | Size: 24 KiB |
|
Before Width: | Height: | Size: 820 KiB After Width: | Height: | Size: 820 KiB |
|
Before Width: | Height: | Size: 470 KiB After Width: | Height: | Size: 470 KiB |
|
Before Width: | Height: | Size: 74 KiB After Width: | Height: | Size: 74 KiB |
|
Before Width: | Height: | Size: 239 KiB After Width: | Height: | Size: 239 KiB |
|
Before Width: | Height: | Size: 314 KiB After Width: | Height: | Size: 314 KiB |
|
Before Width: | Height: | Size: 181 KiB After Width: | Height: | Size: 181 KiB |
|
Before Width: | Height: | Size: 4.1 KiB After Width: | Height: | Size: 4.1 KiB |
|
Before Width: | Height: | Size: 257 KiB After Width: | Height: | Size: 257 KiB |
|
Before Width: | Height: | Size: 46 KiB After Width: | Height: | Size: 46 KiB |
|
Before Width: | Height: | Size: 19 KiB After Width: | Height: | Size: 19 KiB |
|
Before Width: | Height: | Size: 30 KiB After Width: | Height: | Size: 30 KiB |
|
Before Width: | Height: | Size: 448 KiB After Width: | Height: | Size: 448 KiB |
|
Before Width: | Height: | Size: 20 KiB After Width: | Height: | Size: 20 KiB |
|
Before Width: | Height: | Size: 39 KiB After Width: | Height: | Size: 39 KiB |
|
Before Width: | Height: | Size: 143 KiB After Width: | Height: | Size: 143 KiB |
|
Before Width: | Height: | Size: 28 KiB After Width: | Height: | Size: 28 KiB |
|
Before Width: | Height: | Size: 27 KiB After Width: | Height: | Size: 27 KiB |
|
Before Width: | Height: | Size: 320 KiB After Width: | Height: | Size: 320 KiB |
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
|
Before Width: | Height: | Size: 120 KiB After Width: | Height: | Size: 120 KiB |
|
Before Width: | Height: | Size: 67 KiB After Width: | Height: | Size: 67 KiB |
|
Before Width: | Height: | Size: 11 KiB After Width: | Height: | Size: 11 KiB |
|
Before Width: | Height: | Size: 118 KiB After Width: | Height: | Size: 118 KiB |