Expansion of host vitals

[noahtalerman]

Problem

I'm an engineer managing thousands of hosts and I'm overwhelmed with tracking my goals for each of these hosts.

This makes is hard to make progress on my goals because I don't know what hosts I need to take action on.

The following are my goals:

1. Know how many hosts, and which hosts, are running unsupported Windows versions.
2. Know how many hosts, and which hosts, have a certain amount of remaining disk space.
3. Know how many hosts, and which hosts, have Munki issues.
4. Know how many hosts, and which hosts, are enrolled in a specific Mobile device management (MDM) solution.
5. Know how many hosts, and which hosts, have MDM issues.
6. Know which Active Directory (AD) users use a host.
7. Know how many hosts, and which hosts, have last checked into Fleet at certain time intervals.

Child epics

• #6428
• #6429
• #6430
• #6433
• #6434
• #6431
• #6435

[noahtalerman]

Update 4.14.2021

The latest mockups can be found in Fleet EE (scratchpad) here: https://www.figma.com/file/hdALBDsrti77QuDNSzLdkx/%F0%9F%9A%A7-Fleet-EE-scratchpad?node-id=1076%3A5272

[noahtalerman]

The majority of information required for this feature requires osquery extensions. Orbit can manage these extensions.

[noahtalerman]

Linking to the "Add the "Home" page to the Fleet UI" issue here: #1319

[noahtalerman]

Tip from a community member:

osquery query to determine the "Most active apps" that uses a constructed munki_app_usage table:

SELECT event,
       bundle_id,
       app_version,
       app_path,
       last_time,
       number_times
FROM munki_app_usage
WHERE event != "quit"
  AND app_path not like "/System%"
  AND CAST(number_times AS integer) > 5
  AND CAST(last_time AS INTEGER) >
    (SELECT CAST(strftime('%s', 'now', '-90 day') AS INT))
ORDER BY CAST(number_times AS INTEGER) DESC;

The following can be added to the config yaml configuration file to construct this table using Fleet:

apiVersion: v1
kind: config
spec:
  agent_options:
    config:
      options:
        ...
    overrides:
      platforms:
        darwin:
          auto_table_construction:
            munki_app_usage:
              columns:
                - event
                - bundle_id
                - app_version
                - app_path
                - last_time
                - number_times
              path: /Library/Managed Installs/application_usage.sqlite
              query:
                select event, bundle_id, app_version, app_path, last_time, number_times
                from application_usage

[noahtalerman]

Hey @n8felton and @lctrkid, this is the issue that currently tracks future improvements to the Home page (dashboard) in Fleet.

Is the following interpretation of our previous call correct?

• One of the best parts about Sal is the ability to drill down from a summary of hosts into a list of specific hosts (ex. see all hosts with macOS 12.3.1)
• Operating system information is most important.
• Information related to installs and patches triggered via Munki is very valuable for determining if a device is expected to receive a software update.
• Visual representations of the data (ex. pie charts) are helpful for getting a quick answer to "where's my Fleet at?"

Also, I recall us discussing the SIP widget in Sal. Today in Fleet, adding the following "System Integrity protection enabled" policy will present you with the ability to drill down into a list of hosts that have SIP enabled/disabled: https://fleetdm.com/queries/system-integrity-protection-enabled-mac-os

[n8felton]

One of the best parts about Sal [or MunkiReport] is the ability to drill down from a summary of hosts into a list of specific hosts (ex. see all hosts with macOS 12.3.1)

This is correct. The idea is that you can start out broad (e.g. top-level chart or table of macOS versions for entire fleet), but then you can get more detailed information as you click down into the rabbit hole.

• Clicking 12.3 takes you to a list of hosts with macOS 12.3 with column headers that present useful and actionable information, e.g. Serial Number, Hostname, Primary user, last updated (when the information was refreshed).
  • In version 4.14.0 of Fleet today, this might look a lot like the /hosts/manage path.
• Clicking a host in the list takes you to a detailed view of that particular host.
  • In version 4.14.0 of Fleet today, this might be the /hosts/1 path

Operating system information is most important.

I wouldn't say "most important", however, it's certainly an easy place to start. It would allow us to find the devices in our fleet that are out of compliance and allow us to dive into the details on those devices to help determine why they may not have updated, or to get the user information to reach out to the user to ask them to update. I would say that 3rd party application versions are equally as important to help us identify which users have vulnerable versions of applications in the fleet.

Information related to installs and patches triggered via Munki is very valuable for determining if a device is expected to receive a software update.

Yes, this relates to knowing 3rd party application versions.

Visual representations of the data (ex. pie charts) are helpful for getting a quick answer to "where's my Fleet at?"

Yes, but to add to this, color coding the data helps. This is typically done with "traffic light colors" - green = good, yellow/orange = warning, red = bad.

[zhumo]

Can we remove this from the roadmap board, and then put the child epics on the roadmap board when they're in the appropriate state? Otherwise, this is gonna sit here for a long time.

[noahtalerman]

Hey @Patagonia121, during feature fest, we discussed that we brought this request to feature fest because customer-ufa is looking for the ability to add custom data to the Host details page.

This was addressed by this separate user story: "See latest query results per-host": #14415 (shipped in Fleet 4.42)

Have we gotten any feedback from the customer on the "See latest query results per-host" feature yet?

[noahtalerman]

Closed this issue this issue because 5 and 6 (from "Problem" section below) are now tracked in separate issues: https://github.com/fleetdm/fleet/issues/6434 and https://github.com/fleetdm/fleet/issues/9783 respectively.

More information is in the issue description here: https://github.com/fleetdm/fleet/issues/397#issue-823509884

[fleet-release]

Hosts in the thousands, Fleet eases your burdened mind, Vitals clear, defined.