General information and flag documentation can be accessed by running orbit -help. The up-to-date documentation for Orbit is maintained in the Fleet repository. To report a bug or request a feature, click here.

Refresh after several seconds (≈30s), and you should now see your local computer as a new host in Fleet. Now run that installer (double click, on a Mac) to enroll your own computer as a host in Fleet. With fleetctl preview running, you can find your Fleet enroll secret by selecting the 'Add new host' button on the Hosts page in the Fleet UI.Īn installer configured to point at your Fleet instance has now been generated. cmd/package -type=pkg -fleet-url=localhost:8412 -insecure -enroll-secret=YOUR_FLEET_ENROLL_SECRET_HERE Based on insights from osquery data, your team can program automated rules to trigger real-time alerts when malicious acts or intrusions occur within your systems. # Generate a macOS installer pointed at your local Fleet Osquery can help any security team with threat hunting, forensics, and intrusion detection by providing real-time views of every running process and network connection. Try Orbit With fleetctl preview already running and Go installed: # From within the top-level directory of this repo… But Orbit can be used with or without Fleet, and Fleet can be used with or without Orbit. Orbit is the recommended agent for Fleet. Orbit eases the deployment of osquery connected with a Fleet server, and is a (near) drop-in replacement for osquery in a variety of deployment scenarios. With Orbit, it's easy to deploy osquery, manage configurations, and stay up to date. Orbit is an osquery runtime and autoupdater.

Osquery slack