Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 52

Add instructions for moving queries and packs from one Fleet env to another (#307)

Browse source 
Add documentation that includes lean instructions for exporting queries and packs from one Fleet environment and importing them in another.
This commit is contained in:
noahtalerman 2021-02-16 14:48:19 -08:00 committed by GitHub
parent 06d919aa4e
commit 8438278ba3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
docs/1-Using-Fleet/2-fleetctl-CLI.md
View file

@ -12,6 +12,7 @@
- [Convert osquery JSON](#convert-osquery-json)
- [Osquery queries](#osquery-queries)
- [Query packs](#query-packs)
- [Moving queries and packs from one Fleet environment to another](#moving-queries-and-packs-from-one-fleet-environment-to-another)
- [Host labels](#host-labels)
- [Osquery configuration options](#osquery-configuration-options)
- [Auto table construction](#auto-table-construction)
@ -348,6 +349,14 @@ spec:
removed: false
```
#### Moving queries and packs from one Fleet environment to another
When managing multiple Fleet environments, you may want to move queries and/or packs from one "exporter" environment to a another "importer" environment.
1. Navigate to `~/.fleet/config` to find the context names for your "exporter" and "importer" environment. For the purpose of these instructions we will use the context names `exporter` and `importer` respectively.
2. Run the command `fleetctl get queries --yaml --context exporter > queries.yaml && fleetctl apply -f queries.yml --context importer`. This will import all the queries from your exporter Fleet instance into your importer Fleet instance. *Note, this will also write a list of all queries in yaml syntax to a file names `queries.yml`.*
3. Run the command `fleetctl get packs --yaml --context exporter > packs.yaml && fleetctl apply -f packs.yml --context importer`. This will import all the packs from your exporter Fleet instance into your importer Fleet instance. *Note, this will also write a list of all packs in yaml syntax to a file names `packs.yml`.*
### Host labels
The following file describes the labels which hosts should be automatically grouped into. The label resource should include the actual SQL query so that the label is self-contained:
@ -665,5 +674,3 @@ can be helpful to debug carving problems.
This value must be less than the `max_allowed_packet` setting in MySQL. If it is too large, MySQL will reject the writes.
The value must be small enough that HTTP requests do not time out.