0af5e161d0
* Renaming files and a lot of find and replace * pageRank meta tags, sorting by page rank * reranking * removing numbers * revert changing links that are locked to a commit * update metatag name, uncomment github contributers * Update basic-documentation.page.js * revert link change * more explicit errors, change pageOrderInSection numbers, updated sort * Update build-static-content.js * update comment * update handbook link * handbook entry * update sort * update changelog doc links to use fleetdm.com * move standard query library back to old location, update links/references to location * revert unintentional link changes * Update handbook/community.md Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
3.7 KiB
Fleet UI
Scheduling queries
The Fleet application allows you to schedule queries. This way these queries will run on an ongoing basis against the hosts that you have installed osquery on. To schedule specific queries in Fleet,you can organize these queries into "Query Packs". To view all saved packs and perhaps create a new pack, select "Schedule" from the top navigation and then click on the "Advanced" link on the top right of the page.
If you select a pack from the list by clicking on the checkbox next to it's name, you can quickly enable and disable the entire pack, or you can click on the pack name to edit it further.
When you edit a pack, you can decide which targets you would like to execute the pack. This is a similar selection experience to the target selection process that you use to execute a new query.
To add queries to a pack, click on the "Add query +" link on the edit pack page. You will be presented with a modal where can take an existing scheduled query and add it to the pack. You can also define a few key details such as:
- interval: how often should the query be executed?
- logging: which osquery logging format would you like to use?
- platform: which operating system platforms should execute this query?
- minimum osquery version: if the table was introduced in a newer version of osquery, you may want to ensure that only sufficiently recent version of osquery execute the query.
- shard: from 0 to 100, what percent of hosts should execute this query?
Once you've scheduled queries and curated your packs, you can read our guide to Working With Osquery Logs.
Configuring agent options
The Fleet application allows you to specify options returned to osqueryd when it checks for configuration. See the osquery documentation for the available options.
Global agent options
Global agent options are applied to all hosts enrolled in Fleet.
Only user's with the Admin role can edit global agent options.
To configure global agent options, head to Settings > Organization settings > Global agent options.
Team level agent options
Applies only to Fleet Premium
ℹ️ In Fleet 4.0, Teams were introduced.
Team agent options are applied to all hosts assigned to a specific team in Fleet.
Team agent options override global agent options.
Let's say you have two teams in Fleet. One team is named "Workstations" and the other named "Servers." If you edit the agent options for the "Workstations" team, the hosts assigned to this team will now receive these agent options instead of the global agent options. The hosts assigned to the "Servers" team will still receive the global agent options.
To configure team agent options, head to Settings > Teams > Team-name-here > Agent options.
