Deploy Fleet to centrally manage osquery agents across an endpoint fleet, enroll hosts over TLS, and run scheduled and live distributed queries
domain: fleetdm.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Stand up the Fleet server behind TLS and generate an enroll secret for onboarding new hosts.
Deploy osqueryd to endpoints configured with Fleet's server URL, the CA certificate, and the enroll secret so hosts register through Fleet's enroll endpoint.
Enrolled hosts periodically call Fleet's config and distributed-query-read endpoints to pull scheduled queries and policy checks, then post results back via the distributed-query-write and log endpoints.
Define scheduled queries for continuous telemetry and policy queries for pass/fail compliance checks, and use live distributed queries for on-demand investigation across some or all of the fleet.
Use labels — dynamic host groups computed from query results — to target specific query packs at subsets of the fleet, such as by OS or installed software.
Known gotchas
osqueryd will not connect to Fleet unless the connection is over TLS with a valid chain; a broken or self-signed CA setup silently blocks enrollment.
Policy queries report pass/fail per host but don't alert on their own — results need to be piped to a separate alerting or SIEM pipeline to act on failures.
Scheduling very frequent or expensive queries fleet-wide can noticeably load both endpoints and the Fleet backend, especially at large host counts.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?