Commit graph

2524 commits

Author SHA1 Message Date
Mason Buettner
b3fa01a144
Add disable-insider-ui-page.ps1 (#34499)
This script disables the UI page where users can opt into the Windows
insider program.


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

## Testing

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 13:57:12 -04:00
Graham Williams
4dc76ec838
Create windows-device-privacy-speechrecognition-disabled.xml (#34505)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI
- Event Viewer shows no errors
- Ability to enable service disabled

<img width="1025" height="406" alt="image"
src="https://github.com/user-attachments/assets/13efdd05-7248-4dc5-b41f-0d550b3c3f0e"
/>

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 13:02:55 -04:00
Brock Walters
d4dabf4783
Add configuration to block user account details on sign-in (#34622) 2025-10-22 12:59:12 -04:00
Harrison Ravazzolo
bb4717da1f
Enable SmartScreen, Prompt for user elevation CSP (#34445) 2025-10-22 12:51:25 -04:00
Graham Williams
27bbebc122
Create windows-device-systemservices-simptcp-disabled.xml (#34502)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI (Requires device restart)
- Event Viewer shows no errors
- Service shows as disabled
2025-10-22 10:09:59 +01:00
Graham Williams
e08b34c8e2
Create windows-device-remoteassistance-disabled.xml (#34503)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI (Requires device restart)
- Event Viewer shows no errors
- Requesting Remote Assist fails

<img width="1461" height="1034" alt="image"
src="https://github.com/user-attachments/assets/3eb29616-0dbc-495a-bf35-51b60d49bd11"
/>

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 10:09:36 +01:00
Graham Williams
3144b1eacc
Create windows-device-networkaccess-everyonepermissions.xml (#34508)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#networkaccess_leteveryonepermissionsapplytoanonymoususers)
- Profiles return as **Verified** in FleetUI
- Event Viewer shows no errors

<img width="1468" height="296" alt="image"
src="https://github.com/user-attachments/assets/cfd23f13-c47a-4aa7-a7b3-604ec7421a15"
/>

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 10:09:21 +01:00
Dale Ribeiro
b0895b9e23
Added acccount-lock-out.xml (#34619) 2025-10-21 18:02:44 -04:00
Noah Talerman
3b2717f4fd
YAML reference (#34604)
Use serial numbers for labels example. Serial numbers is best practice.
2025-10-21 14:15:57 -05:00
Harrison Ravazzolo
fdc184fe58
Windows CSP - Spotlight config + Okta scep (#34589) 2025-10-21 08:47:50 -07:00
George Karr
33650644c8
Update sprint retrospective guidelines with tool recommendations (#34543) 2025-10-20 15:22:43 -05:00
Rachael Shaw
7ed4aac2b8
Docs v4.75.0 (#34443)
Documentation changes for the 4.75 release

---------

Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Tim Lee <timlee@fleetdm.com>
Co-authored-by: Janis Watts <184028114+jmwatts@users.noreply.github.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
2025-10-17 17:45:52 -05:00
jacobshandling
5f626e2a8c
Add gigs_all_disk_space vital collection, storage, service, and UI rendering for Linux hosts (#34077)
## Addresses #31671 

- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added total disk space metrics for all partitions on Linux hosts. The
disk space indicator now displays comprehensive storage information
including root partition and all other partitions, improving visibility
into host storage capacity.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2025-10-17 08:24:23 -07:00
RachelElysia
1ef91fe4e3
Feature: Script only package e2e followup (#34271)
Co-authored-by: Carlo DiCelico <carlo@fleetdm.com>
2025-10-17 10:54:00 -04:00
Allen Houchins
6a04a40c9a
Refine JIT user provisioning description in SSO docs (#34434)
Clarified explanation of JIT user provisioning and account creation
process.
2025-10-17 09:08:33 -05:00
Zach Wasserman
004e473887
Add query for MCP configurations (#34404)
**Related issue:** Part of #29969
2025-10-16 17:55:55 -05:00
Brock Walters
92a58851fa
Added new Set_ScreenSaverGracePeriod.ps1 script (#34340)
This script is part of the CSA project to create Windows controls for
customer-rembrandt.
2025-10-16 11:08:36 -05:00
Graham Williams
2f6cacb09d
Create Profile: Disable Local Administrator (#34344)
- Administrator account starts as enabled: True
- Profile verifies: True
- Administrator account disabled after apply: True

<img width="1654" height="1113" alt="image"
src="https://github.com/user-attachments/assets/9551d87a-341a-49e3-8d0b-15c86ea1b81c"
/>

<img width="2043" height="424" alt="image"
src="https://github.com/user-attachments/assets/acbfa66d-2684-43b8-a964-f7679fd861e8"
/>
2025-10-16 11:08:04 -05:00
Ian Littman
e48d8033a9
Map manjaro-arm platform (#34357)
Resolves #34318. Thx @jmwatts for the QA on this!

- [x] QA'd all new/changed functionality manually
2025-10-16 11:00:05 -05:00
Noah Talerman
0e9bba4774
YAML reference: Typo: "self_service" (#34202) 2025-10-14 17:06:25 -05:00
jacobshandling
05b8ba4a32
Update gitops labels docs (#34207)
Small docs fixes
2025-10-14 17:06:01 -05:00
Tim Lee
2b18caaee1
Add Jetbrains plugins (#34024) 2025-10-14 09:01:45 -06:00
Ian Littman
bbc36bbc83
Fall back to app filename when ingesting macOS apps that have no display name/bundle name and run.sh as the bundle executable (#34176)
Fixes #34157. Seen on Steam games, which also don't have a bundle ID.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [x] QA'd all new/changed functionality manually
2025-10-13 17:33:20 -05:00
Mason Buettner
e78ad1b9ca
Fix typo in REST API "Request certificate" (#34092)
Changes:
 - Changed "isseud" to "issued" in `idp_client_id`.
2025-10-10 12:06:02 -05:00
Noah Talerman
9034d13b65
API reference: Clarify 'pending' (#33960) 2025-10-08 16:47:31 -04:00
Victor Lyuboslavsky
e274738b9d
Instructions to create a public mTLS reverse proxy (#33906)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #33165

Doc updates only.
2025-10-08 14:46:33 -05:00
Zach Wasserman
41c53860e3
Add support for VSCode fork extensions in software inventory (#33595)
**Related issue:** Resolves #31397

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2025-10-07 14:05:22 -07:00
Harrison Ravazzolo
9e3cab666e
Update doc assets (#33740)
After talking with eng team and @nonpunctual, the /assets folder is
reserved for things inside the fleet app, so creating a new folder in
`/docs/solutions`

@AdamBaali - I updated your article paths and moved the assets to the
new folder, do you mind taking a peek and making sure it looks good?

Note: brock, we should also update handbook for new ritual to add
articles with assets like this.

---------

Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
2025-10-07 13:02:36 -06:00
Rachael Shaw
75104bfbcb
Rename "Single sign-on options" settings page to "Single sign-on (SSO)" (#33946)
As part of https://github.com/fleetdm/fleet/issues/25798, we planned to
rename "Single sign-on options" to "Single sign-on (SSO)". However, we
missed adding a check for the copy change in the test plan, so we didn't
catch that the change didn't make it in.

The documentation/guide changes referencing the new page name were
already merged as part of 4.71.
2025-10-07 13:38:37 -05:00
Rachael Shaw
b94aba24aa
Remove duplicate certificate authorities example from YAML docs (#33931)
There was an extra one left over from merging in doc updates.
2025-10-07 08:59:30 -05:00
Gabriel Hernandez
95c559fbab
Add host platform to mdm enrolled and mdm unenrolled activity details (#33858)
**Related issue:** Fixes #33807

Adds missing host platform key to mdm enrolled and mdm unenrolled
activity details api response data. This allows the UI to display the
activities properly

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
2025-10-07 14:22:37 +01:00
Rachael Shaw
48cb0908cd
Docs v4.74.0 (#33879)
Documentation changes for 4.74

---------

Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Janis Watts <184028114+jmwatts@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
2025-10-06 17:03:10 -05:00
Noah Talerman
46df8f8274
API reference: Remove errant key (#33898) 2025-10-06 17:01:11 -05:00
Noah Talerman
e1ca48f549
Supported host operating systems (#33861)
- openSUSE 15.6+
- Lowercase "openSUSE"

Supported added in the following user story:
- #32778
2025-10-06 11:59:35 -05:00
Lucas Manuel Rodriguez
527c2230e9
Add support for legacy Company portal SSO extension (#33796)
Resolves #33319

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] QA'd all new/changed functionality manually
2025-10-03 17:56:38 -03:00
Victor Lyuboslavsky
5ff5332026
Added SSF to Okta research doc. (#33720)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #32766
2025-10-03 08:16:41 -05:00
Noah Talerman
279cc8d0d4
YAML reference: Only one package, App Store app, or Fleet-maintained app per software (#33707)
Docs to address the following bug:
- #32607
2025-10-02 19:06:02 -05:00
Noah Talerman
5ee9fa774c
API reference: OTA profiles don't work if end user auth is enabled (#33705)
- @noahtalerman: We shipped a breaking change in Fleet 4.73 that
resulted in this bug: https://github.com/fleetdm/fleet/issues/33447
 - To fix this bug we decided to...
- Accept this breaking change, document it (this PR), and add an
improved error message. See
[bug](https://github.com/fleetdm/fleet/issues/33447).
- Improve the manual enrollment flow for macOS hosts. User story is
[here](https://github.com/fleetdm/fleet/issues/33640).
   - Both changes are targeted for 4.77
2025-10-02 19:05:09 -05:00
Allen Houchins
df0d60a8f4
Update rest-api.md (#33702)
- Added additional platform information to address confusion encountered
during a recent prospect call.

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-10-02 18:48:16 -05:00
Eric
9e520f22dd
Docs: Update anchor link in Upgrading-Fleet.md (#33784)
Changes:
- Fixed an anchor link in the Upgrading Fleet documentation
2025-10-02 15:44:28 -05:00
Victor Lyuboslavsky
0498b2f200
Added research doc for osquery ebpfpub replacement (#33722)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #30639
2025-10-02 11:33:09 -05:00
Noah Talerman
a5978d16d9
YAML files: Add missing key (#33574)
Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-09-30 18:09:58 -05:00
Steven Palmesano
267a16d8e4
Update links for end user authentication in SSO documentation (#33623)
These redirected to the correct page, but the anchor was broken.
2025-09-30 18:08:23 -05:00
Jordan Montgomery
cfbc9d8829
Fix osquery detection of vscode extensions (#33523)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #33520 

Recent changes to the users query accidentally introduced an ambiguous
column error with the vscode extensions query. Fixed the SELECT
statement in vscode_extensions to properly account for this

No changes file added since this is an unreleased bug and the feature
has a changes file

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

No automated tests in this area so no tests to update/add

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results
2025-09-26 15:22:45 -04:00
Noah Talerman
65989fbfc6
API reference: Which software supports last_opened (#33459)
Context:
https://github.com/fleetdm/fleet/issues/31268#issuecomment-3319200507

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-09-26 12:37:36 -05:00
Noah Talerman
375d7e8046
API reference: Which software supports hash_sha256 (#33506)
Context:
2025-09-26 12:35:42 -05:00
Sarah Gillespie
128a71eb4f
Add backend support for Smallstep CA (#32872)
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
2025-09-25 10:03:36 -05:00
Steven Palmesano
4a47305353
Change Mac script references from .ps1 to .sh (#33407)
Our example shows a Mac app using .ps1 scripts, but Macs don't use
PowerShell.
2025-09-24 10:12:34 -05:00
Mike Thomas
4bddc81357
Update why-fleet.md (#33257)
Closes https://github.com/fleetdm/fleet/issues/22566

I added scope transparency information based on @JoGSal 's suggestion
from [this issue](https://github.com/fleetdm/fleet/pull/20726/files).
The content was rewritten in Fleet's plain, straight-talking tone to
match the rest of the page, e.g., short sentences and active voice.

I also removed some instances of `<0xa0>` non-breaking spaces from the
section above.
2025-09-24 08:02:08 +09:00
Dante Catalfamo
834ab62ed0
Use new pacman table to ingest software from arch linux (#33238)
#32862
2025-09-23 10:28:32 -04:00