Fleet Device Management

The cpu_info table expresses the data made available from a computer or mobile device by its Central Processing Unit (CPU). Basic query: select * from cpu_info; The cpu_info table is a good example of the cross-platform capabilities of osquery. The cpu_info table can be used on Linux, Mac, and Windows machines. The CPU metadata made available across the different platforms may differ, but it will still show you everything you need to know. I was curious about what it pulls from my editing rig. Maybe you'll find it interesting: host: DrewPdrawersPC current_clock_speed: 3701 logical_processors: 24 load_percentage: 8 number_of_cores: 12-Core model: AMD Ryzen 9 5900X 12-Core Processor socket_designation: AM4 Yes, I like my processor 🤓 Learn more: https://lnkd.in/eqkBDddY

The chrome_extensions table maps Chrome extensions installed in Chromium-based browsers. Basic query: select * from users cross join chrome_extensions using (uid); This query merges data from the users table with Chrome extension details: select u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions from users u cross join chrome_extensions ce using (uid) where ce.permissions like '%%https://*/*%%'; It focuses on extensions that request broad permissions, specifically those that can access all URLs (%%https://*/*%%). This is a common red flag for potential security risks. Keeping tabs on which browser extensions are installed in an organization can help with: Compliance audits - Ensure extensions comply with company policies. Security training - Educate users about Chrome extension risks. Incident response: Identify suspicious or vulnerable extensions. Monitoring chrome_extensions uncover malicious extensions like these: https://lnkd.in/enwqrGxf Enabled permissions can be an indicator of malicious intent: https://lnkd.in/eandppxw Check out the Fleet table data docs! https://lnkd.in/eKnyQ83U

What's up with CVSS4? A bunch of new changes to help security teams contextualize and prioritize vulnerabilities. Thank you Mainland Advanced Research Society (MARS) for having me, and special thanks to Patrick Garrity 👾🛹💙 who posted some great diagrams and research about CVSS4 on LinkedIn! https://lnkd.in/gNw7bN-m Slides: https://lnkd.in/gKwPdf3s

Endpoint management's crucial role in healthcare💡 🚨 Protect sensitive patient data 💻 Centralize and secure diverse devices 🚫 Mitigate human error with app allowlisting 📈 Ensure HIPAA compliance Prioritize endpoint management for trust and security: https://lnkd.in/esPzVfcC

The Address Resolution Protocol (ARP) cache maps IP addresses to MAC addresses in the network stack on Linux, macOS & Windows. Basic query: select address, interface, mac from arp_cache; Compare gateway IP addresses (which are typically routers) to a list of known MAC addresses: select * from arp_cache where address in (insert_gateway_ips) and mac not in (insert_expected_mac_addresses);   The first six digits of a MAC address are the known as the Organizationally Unique Identifier: https://lnkd.in/eU3-474B Manufacturer and model information can be looked up by MAC address using Wireshark OUI Lookup: https://lnkd.in/e_6TJd3b OUI is used to populate manufacturer information in applications like Wi-Fi Explorer: https://lnkd.in/exebKf9t ARP Cache: https://lnkd.in/ecCKYV-f Monitoring the ARP cache is useful for maintaining network integrity & security. Querying data from this table can help to: - Find network anomalies - Troubleshoot network connectivity - Uncover ARP Spoofing: https://lnkd.in/eizQDuKC   Check out the Fleet Table Data docs! https://lnkd.in/evVMZnjV

Have you ever been affected by a reboot or app upgrades? Post your story in the comments below! I think I used that excuse one too many times with my old boss at Planview Steve Gresham. Sorry for being LATE, Steve! Also, kudos to you for calling me out! You'd love me now that Fleet Device Management puts IT maintenance in my calendar when I have time! A great interview with our CEO Mike McNeil about the feature and its background by Bradley Chambers on 9to5Mac Apple@Work podcast. https://lnkd.in/gQUKERg7

Fleet 4.50.0 is live 🚀 🔐 Deploy security agents to macOS, Windows, and Linux 🔮 Policy description and resolutions aided by AI 📃 Mac Admins SOFA support ⚙ `zsh` support Learn more: https://lnkd.in/etstkiiM

Embracing clarity and efficiency with AI 💡 Fleet's new AI-assisted features simplify policy management by providing clear, actionable descriptions and resolutions. Learn more: https://lnkd.in/gK-TJZWV

The macOS authorizationdb is used by Mac admins to give their users or themselves granular permissions on the Macs they manage. The authdb Fleet osquery table expresses the data found in the macOS authorizationdb. The authorizationdb is a SQLite database that can be dumped out with the following Terminal command: sudo /usr/bin/sqlite3 /var/db/auth.db .dump Apple’s documentation: https://lnkd.in/eFs6BFg3 An authorizationdb general purpose article can be found here: https://lnkd.in/ePaazEkn Armin Briegel (Scripting OS X) on the macOS root user and the authorizationdb: https://lnkd.in/ePnna7n3 Elliot Jordan on using the authorizationdb in his tool Escrow Buddy: https://lnkd.in/eMF7Y4f8 The following Terminal command generates a .plist showing the attributes of the authorizationdb configuration: security authorizationdb read system.login.console Use a “right_name” string like system.login.console as the value in the mandatory WHERE clause when querying this table: SELECT * FROM authdb WHERE right_name='system.login.console'; Check out the Fleet Table Data docs for more information! https://lnkd.in/eBx-PV8z

We've updated our deployment documentation to make it easier than ever🚀 ⌚ Deploy to Render in under five minutes 🌎 Deploy Fleet at scale using AWS with Terraform 💻 Try Fleet locally on your device Learn more: https://lnkd.in/eXDWFDFz