stevery / fleet

The premier osquery fleet manager.

Website   News   Report a bug

   

Fleet is the most widely used open source osquery manager. Deploying osquery with Fleet enables programmable live queries, streaming logs, and effective management of osquery across 50,000+ servers, containers, and laptops. It's especially useful for talking to multiple devices at the same time.

Try Fleet

With Node.js installed:

# Get the Fleet command-line tool
npm install -g fleetctl

With Docker installed:

# Run a local demo of the Fleet server
fleetctl preview

A local copy of the Fleet server is now running at https://localhost:8412.

Adding hosts

Now that you've finished setting up Fleet, you will want to enroll a server, container, or laptop so you have something to run queries against.

Fleet comes with simulated hosts you can use for demo purposes.

First, finish setting up Fleet in the browser and retrieve your "Enroll Secret" by clicking the "Add New Host" button in the Fleet dashboard.

Then after cloning this repository, cd into the osquery/ directory:

cd osquery/

This directory contains configuration that can start up Docker containers running osquery agents. To start them up:

ENROLL_SECRET=<paste your enroll secret here> docker-compose up

Now navigate back to https://localhost:8412 or refresh to see your new hosts in Fleet!

Your first query

Ready to run your first query? Target some of your sample hosts and try it out:

Team

Fleet is independently backed and actively maintained with the help of many amazing contributors.

🎉 Announcing the transition of Fleet to a new independent entity 🎉

Please check out the blog post to understand what is happening with Fleet and our commitment to improving the product. To upgrade from Fleet ≤3.2.0, just grab the latest release from this repository (it'll work out of the box).

Documentation

Documentation for Fleet can be found here on GitHub.

Community

Chat

Please join us in the #fleet channel on osquery Slack.

Community projects

Below are some projects created by Fleet community members. Please submit a pull request if you'd like your project featured.

• Kolide Cloud ("K2") is a cloud-hosted, user-driven security SaaS application. To be clear: Kolide ≠ Fleet.
• davidrecordon/terraform-aws-kolide-fleet - Deploy Fleet into AWS using Terraform.
• deeso/fleet-deployment - Install Fleet on a Ubuntu box.
• gjyoung1974/kolide-fleet-chart - Kubernetes Helm chart for deploying Fleet.