DOCSEARCHbyAlgolia
Submit Docs

Fleet Device Management

website·Indexed 37 days ago

https://fleetdm.com/docs

An open-source device management platform for macOS, Windows, and Linux. Documentation includes guides on implementing real-time monitoring using osquery evented tables, configuring File Integrity Monitoring (FIM) and process auditing with flags like `--disable_events=false` and `--enable_file_events=true`, and managing YARA rules for the `yara_events` table.

Tokens
2M
Snippets
5.2K
Records
11.5K
Agent score
72%

What's inside Fleet

  1. Overview of Fleet endpoint management platform

    Fleet is a single endpoint management platform supporting macOS, iOS, Android, Windows, Linux, ChromeOS, and cloud infrastructure. It applies infrastructure-as-code (IaC) practices to device management to ensure endpoints remain secure and operational while reducing manual configuration drift.

  2. Overview of Fleet device management platform

    Fleet is an open-source device management platform used to secure and maintain computing devices over the air. It supports macOS, Linux, Windows, Chromebooks, iOS, and Android devices, regardless of whether they are corporate-owned or Bring Your Own Device (BYOD). Key capabilities include Mobile Device Management (MDM), patching, software deployment, and system verification across multiple operating systems from a single interface.

  3. Overview of osquery

    Osquery is an open-source operating system monitoring tool that exposes a device's operating system as a high-performance relational database. It allows users to query the underlying state of an OS using standard SQL statements across Windows, macOS, and Linux (including Ubuntu and Debian). It is designed to be lightweight and fast, providing a single-agent solution for security and administration teams to monitor system health, status, and vulnerabilities.

  4. Overview of Fleet endpoint management

    Fleet is an endpoint management platform supporting macOS, iOS, Android, Windows, Linux, ChromeOS, and cloud infrastructure. It applies infrastructure-as-code (IaC) practices to device management to help IT and security teams maintain security and operational status across endpoints. Fleet supports multiple deployment models: on-premises, air-gapped, container-native (Docker and Kubernetes), cloud-agnostic (AWS, Azure, GCP, DigitalOcean), and a fully managed SaaS option via Fleet Cloud.

  5. Overview of Fleet Device Management

    Fleet is an open-core, cross-platform endpoint management platform supporting macOS, iOS, Android, Windows, Linux, ChromeOS, and cloud infrastructure. It utilizes osquery for real-time insights and employs GitOps-driven management (Infrastructure-as-Code) to ensure endpoints remain secure and operational. Fleet is designed for flexibility and scalability, catering to organizations of various sizes through a community-driven development model.

  6. Overview of multi-platform endpoint management

    Endpoint management is the practice of deploying, configuring, securing, and maintaining devices that connect to an organization's network. It covers the full device lifecycle: initial provisioning, ongoing configuration enforcement, software deployment, OS updates, compliance monitoring, and decommissioning. It is essential for closing security gaps created by consumer defaults and meeting compliance frameworks such as NIST SP 800-53, SOC 2, ISO 27001, and HIPAA.

  7. Overview of Fleet Self-service

    Fleet's self-service (available in Fleet Premium) allows end users to update and install approved apps and run scripts from a curated list via the Fleet Desktop > Self-service page. For macOS, Windows, and Linux, it is integrated into Fleet Desktop. For Android, software is available via the Managed Google Play store. For iOS/iPadOS, a webclip must be deployed.

  8. Overview of Mac inventory management

    Mac inventory management is the process of collecting and maintaining records of hardware specifications, installed software, security configurations, and compliance status across a Mac fleet. This is typically achieved by combining Apple's MDM framework, agent-based tools like osquery for continuous SQL-based monitoring, and native macOS utilities like system_profiler. The collected data is often fed into a Hardware Asset Management (HAM) system (e.g., ServiceNow or Snipe-IT) to serve as the authoritative system of record.

  9. Overview of Fleet endpoint management

    Fleet is an open-source system built on osquery for Linux observability and Apple device management. It serves as a single endpoint management platform supporting macOS, iOS, Android, Windows, Linux, ChromeOS, and cloud infrastructure. It allows organizations to inspect, collect, fix, install, patch, and program devices at scale using infrastructure-as-code (IaC) practices.

  10. Overview of custom osquery extensions in Fleet

    Custom osquery extensions allow organizations to gather specific telemetry data not provided by standard osquery or Fleet tables. They enable querying custom data using SQL syntax, avoiding the need for Automatic Table Construction (ATC) or manual parsing of files via tables like file, file_lines, or parse_json.

  11. Overview of Recovery Lock password for Apple Silicon Macs

    Fleet Premium allows IT admins to set, view, and rotate a recovery lock password on Apple Silicon (ARM) Macs enrolled in Fleet MDM. This password enables admins to unlock a device at the recoveryOS screen if the end user forgets their local password or the device requires recovery. Fleet automatically generates, encrypts (AES-256), and stores the password server-side.

  12. Overview of Fleet MDM capabilities

    Fleet is a multi-platform, open-source device management solution supporting macOS, Windows, Linux, iOS, iPadOS, ChromeOS, and Android. It is built on osquery, enabling device state updates in under 30 seconds. Fleet supports both cloud-hosted and self-hosted deployments with identical feature sets. Key native capabilities include vulnerability detection, policy scoring, file integrity monitoring, and incident response.