diff --git a/handbook/company/why-this-way.md b/handbook/company/why-this-way.md index 9917f6efa8..f9a370208b 100644 --- a/handbook/company/why-this-way.md +++ b/handbook/company/why-this-way.md @@ -237,6 +237,17 @@ Many companies encourage salespeople to "spray and pray" email blasts, and to do - **Be genuine.** No puffery. No impressive-sounding words. We are [🟣open and outsider friendly](https://fleetdm.com/handbook/company#openness). We expand acronyms, and insist on using simple language that lets everyone understand and contribute. We help the people we work with grow in their careers and learn from each other. We are sincere, curious, and [🔵fair to competitors](https://fleetdm.com/handbook/company#objectivity). - **Step up.** We look at the [🟠big picture](https://fleetdm.com/handbook/company#ownership). The goal is for the organization using Fleet to be successful, as well as the individuals who decide to use or buy the product. There are multiple versions of Fleet, and so many ways to "do" open-source security and IT. It is in the company's best interest to help engineers pick the right one; even if that's Fleet Free, or another solution altogether. We think about our customer's needs like they are our own. +## Why does Fleet support query packs? + +As originally envisioned by Zach Wasserman and the team when creating osquery, packs are a way to import and export queries into (and out of!) any platform that speaks osquery, whether that's Fleet, [Security Onion](https://securityonionsolutions.com/), an EDR, or even Rapid7. Queries [should be portable](https://github.com/fleetdm/fleet/blob/f711e60de47c69ab8be5bc13cf73fedf88adc338/README.md#lighter-than-air) to minimize lock-in to particular tools. + +The "Packs" section of the UI that began in `kolide/fleet` c. 2017 was an early attempt to segment and target formations of hosts that share certain characteristics. This came with some difficulties with debugging and collaboration, since it could be hard to tell which queries were running on which hosts. It also made it harder to understand what performance impact running all those queries might cause. + +Eventually, when working on some related improvements, it became clear that Fleet needed a better way to organize hosts, controls, reports, and configuration that wasn't tied exclusively to data collection in Splunk. It was time to learn from the original design and come up with a smarter way to group hosts. + +The first step was to add a simpler way to schedule queries, and tuck away the legacy feature called "Packs", so that "packs" refer to what they were originally: a portable way to import and export queries. + +Packs will always be supported in Fleet.