empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 00:45:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
main
fleet/articles/import-and-export-queries-in-fleet.md
Noah Talerman 0cf4fd107e
In articles, remove reference to query packs (#7176) 
* Update snowflake and import queries guides

* Add new image and update seed round article

* Change import queries guide name and add redirect to routes.js

* Add new import queries file

* Fix redirect. Thanks linter

* Update articles/import-and-export-queries-in-fleet.md

Co-authored-by: Chris McGillicuddy <108031970+chris-mcgillicuddy@users.noreply.github.com>

Co-authored-by: Chris McGillicuddy <108031970+chris-mcgillicuddy@users.noreply.github.com>
2022-08-12 15:03:54 -05:00

2.4 KiB
Raw Permalink Blame History

Import and export queries in Fleet

Import and export queries in Fleet

When managing multiple Fleet instances, you may want to move queries from one instance to another. Or, when inspired by queries shared by a member of the osquery community, you might want to import these queries into your Fleet instance. To do this, you need to have access to a Unix shell and the fleetctl CLI tool.

Below are two example scenarios.

Example scenario 1: Moving queries from one Fleet instance to another

Let’s say you use Fleet at work and you also have a Fleet instance in your lab at home. You were testing some queries at home and you want to share these queries with your team at work.

How to export and import queries:

  1. In your home lab, run the fleetctl login command to log in to Fleet.

  2. Run the following command to export your queries into a queries.yml file:

fleetctl get queries --yaml > queries.yml

queries.yml will be created in your current working directory.

  1. Upload your queries.yml file to GitHub so that you can download this file onto your work computer.

  2. At work, with queries.yml downloaded in your current working directory, run the following command to import your queries:

fleetctl apply -f queries.yml

Example scenario 2: Importing community queries into Fleet

You just found a collection of awesome queries for Fleet and you want to import them into your Fleet instance.

How to import queries:

  1. Create a new file, palantir-queries.yml, and paste in the desired queries in the correct Fleet configuration format.
  2. Run the command fleetctl apply -f awesome-queries.yml.

Could this post be more helpful?

Let us know if you can think of any other example scenarios you’d like us to cover.