README
¶
Orbit osquery
Orbit is an osquery runtime and autoupdater. With Orbit, it's easy to deploy osquery, manage configurations, and stay up to date. Orbit eases the deployment of osquery connected with a Fleet server, and is a (near) drop-in replacement for osquery in a variety of deployment scenarios.
Orbit is the recommended agent for Fleet. But Orbit can be used with or without Fleet, and Fleet can be used with or without Orbit.
Try Orbit
With fleetctl preview already running and Go installed:
# From within the top-level directory of this repo…
# Generate a macOS installer pointed at your local Fleet
go run ./cmd/package --type=pkg --fleet-url=localhost:8412 --insecure --enroll-secret=YOUR_FLEET_ENROLL_SECRET_HERE
With fleetctl preview running, you can find your Fleet enroll secret by selecting the "Add new host" button on the Hosts page in the Fleet UI.
An installer configured to point at your Fleet instance has now been generated.
Now run that installer (double click, on a Mac) to enroll your own computer as a host in Fleet. Refresh after several seconds (≈30s), and you should now see your local computer as a new host in Fleet.
Bugs
To report a bug or request a feature, click here.
Capabilities
| Capability | Status |
|---|---|
| Secure autoupdate for osquery | ✅ |
| Secure autoupdate for Orbit | ✅ |
| Configurable update channels | ✅ |
| Full osquery flag customization | ✅ |
Package tooling for macOS .pkg |
✅ |
Package tooling for Linux .deb |
✅ |
Package tooling for Linux .rpm |
✅ |
Package tooling for Windows .msi |
✅ |
| Manage/update osquery extensions | 🔜 |
| Manage cgroups for Linux performance | 🔜 |
Usage
The up-to-date documentation for Orbit is maintained in the Fleet repository.
General information and flag documentation can be accessed by running orbit --help.
Community
Chat
Please join us in the #fleet channel on osquery Slack.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
pkg
|
|
|
certificate
Package certificate contains functions for handling TLS certificates.
|
Package certificate contains functions for handling TLS certificates. |
|
insecure
Package insecure provides an insecure (if it were not obvious yet) TLS proxy that can be used for testing osquery enrollment with a Fleet (or other TLS) server in non-production environments.
|
Package insecure provides an insecure (if it were not obvious yet) TLS proxy that can be used for testing osquery enrollment with a Fleet (or other TLS) server in non-production environments. |
|
osquery
package osquery implements a runtime for osqueryd.
|
package osquery implements a runtime for osqueryd. |
|
packaging
package packaging provides tools for buildin Orbit installation packages.
|
package packaging provides tools for buildin Orbit installation packages. |
|
packaging/wix
Package wix runs the WiX packaging tools via Docker.
|
Package wix runs the WiX packaging tools via Docker. |
|
update
package update contains the types and functions used by the update system.
|
package update contains the types and functions used by the update system. |
|
update/badgerstore
package badgerstore implements the go-tuf LocalStore interface using Badger as a backing store.
|
package badgerstore implements the go-tuf LocalStore interface using Badger as a backing store. |