DOCSEARCHbyAlgolia
Submit Docs

Fleet Device Management and Security Platform

repository·main·Indexed 27 days ago

https://github.com/fleetdm/fleet

An open-source device management and security platform for managing, patching, and securing devices across various operating systems using APIs, GitOps, and webhooks. Documentation includes build and deployment guides for the Fleet Android agent and Fleet Desktop for macOS, including PSSO extension configuration and MDM integration.

Tokens
209.7K
Snippets
388
Records
1.2K
Agent score
90%

What's inside Fleet

  1. Overview of Fleet Device Management

    main

    Fleet is an open-source platform designed for IT and security teams to secure and maintain computing devices at scale. It provides a single system for MDM (Mobile Device Management), software deployment, patching, and device verification across multiple operating systems.

    Key capabilities include:

    • Cross-Platform Support: Linux (all distros), macOS, Windows, Chromebooks, iOS, Android, AWS, GCP, Azure, Containers, and IoT devices.
    • Infrastructure as Code: Manage your fleet using GitOps (YAML files), the REST API, webhook events, or the fleetctl command-line tool.
    • Compliance & Visibility: Includes CIS benchmarks for macOS and Windows, and provides access to extensive hardware, software, and OS data via table references.
    • Integrations: Supports enterprise tools like Snowflake, Splunk, GitHub Actions, Vanta, Elastic, Jira, and Zendesk, as well as configuration management tools like Ansible, Chef, and Puppet.

  2. Overview of Fleet device management capabilities

    main

    Fleet is a multi-platform device management solution built on top of osquery for data collection. It provides a single console to manage macOS, iOS, iPadOS, Windows, Linux, ChromeOS, and Android devices.

    Key features include:

    • Near real-time telemetry: Device data is returned via osquery.
    • API-first & GitOps-native: Designed for automation and declarative control via the fleetctl CLI and Git repositories (e.g., GitHub, GitLab).
    • Flexible Deployment: Can be deployed on-premises, in any cloud (AWS, GCP, Digital Ocean, etc.), on Docker, Kubernetes, or native server hardware. Also available as a managed SaaS offering.
    • Unified Security: Includes vulnerability detection (NVD/EPSS/KEV), YARA-based threat detection, file integrity monitoring, and CIS benchmarks in the base product.

  3. Overview of Goose database migration tool

    main
    Goose is a database migration tool used to manage database evolution. It allows you to manage changes through incremental SQL files or Go functions. The version included in this repository is a customized fork of the original pressly/goose project, specifically tailored for working with Fleet.

  4. Overview of Fleet Slackbot

    main

    Fleet Slackbot is a Slack bot designed for IT and security teams to manage Fleet deployments using natural language. It provides two primary capabilities:

    1. Fleet Data Querying: Ask questions about your fleet (e.g., host counts, policy compliance, or CVE exposure) and receive responses via the Fleet MCP server.
    2. GitOps Configuration Management: Request configuration changes (e.g., adding policies or installing software) via plain English. The bot generates the necessary GitOps YAML and opens a draft GitHub pull request for review.

    Additionally, it can automatically fix CI failures by reading error messages from GitOps CI checks and pushing corrected commits.

  5. Overview of the Fleet TUF Releasing Process

    main

    The releaser.sh script automates the building and releasing of fleetd and osqueryd updates to Fleet's TUF repository (https://updates.fleetdm.com).

    Workflow Summary:

    1. Staging: New releases are first pushed to https://updates-staging.fleetdm.com.
    2. Verification: A smoke test is performed on the staging environment.
    3. Production: Once verified, releases are promoted to production by performing a server-side sync from https://updates-staging.fleetdm.com to https://updates.fleetdm.com.

  6. Overview of NanoDEP tools and library

    main
    NanoDEP is a suite of tools and a Go library designed for communicating with Apple's Device Enrollment Program (DEP) API servers. It includes a server for configuration and proxying, a tool for device synchronization, and a Go library for programmatic access to DEP APIs.

  7. Overview of macOS 26 Tahoe CIS Benchmark Policies

    main
    Fleet provides automated policies for the CIS Apple macOS 26 Tahoe Benchmark, v1.0.0. These policies cover automated recommendations across sections 1 through 6 of the benchmark. Section 7 (Supplemental) is skipped following standard Fleet convention. Manual-only recommendations are documented separately in the Limitations section of the benchmark documentation.

  8. Overview of Fleet Tools Directory

    main

    The tools/ directory contains various development, testing, and operational utilities for Fleet. Tools are organized into functional categories:

    • api/: API interaction and testing
    • loadtest/: Performance and load testing
    • tuf/: The Update Framework (TUF) utilities
    • mdm/: Mobile Device Management (Apple, Windows, Android, migrations)
    • software/: Software and vulnerability management
    • osquery/: osquery testing and development
    • Root-level tools: Single-purpose utilities (e.g., snapshot, backup_db, cloner-check).

  9. Overview of Orbit

    main

    Orbit is a lightweight osquery installer and autoupdater designed to ease the deployment and management of osquery. It is the recommended agent for Fleet, though it can be used independently.

    Key Features:

    • Deployment: Easy deployment of osquery connected to a Fleet server.
    • Configuration: Manages osquery startup flags from a remote Fleet server.
    • Updates: Manages osquery versions and extensions via configurable update servers using The Update Framework (TUF) specification.
    • Release Channels: Supports granular control over agent versioning via release channels.
    • Compatibility: Acts as a (near) drop-in replacement for osquery in various scenarios.

  10. Overview of qacheck

    main
    qacheck is a tool designed to scan a GitHub Project v2 for items located in the ✔️Awaiting QA column. It identifies items that are either missing a QA confirmation checklist or have an unchecked checklist, helping ensure QA processes are followed.

  11. Overview of Fleet device management

    main
    Fleet is a high-agency device management software designed for IT and security teams to configure, patch, and secure computing devices across an organization. It allows teams to manage changes via configuration files (YAML) or through a graphical user interface (GUI) for specific tasks like managing software or labels. Fleet supports workflows where changes are reviewed, merged, and deployed to thousands of endpoints in seconds, with full history tracking and instant rollback capabilities.

  12. Overview of NanoMDM

    main
    NanoMDM is a minimalist Apple MDM (Mobile Device Management) server inspired by MicroMDM. It is designed as a thin, composable layer between HTTP handlers and storage abstractions, making it suitable for horizontal scaling with minimal local state. It supports MySQL and PostgreSQL backends and allows for multiple APNs topics, potentially enabling multi-tenancy.