osquery-in-a-box
osquery-in-a-box copied to clipboard
Simple Docker-based quickstart for osquery, Fleet, and ELK stack
trafficstars
Try out osquery and Fleet
Check out fleetctl preview for a one-step solution to try out Fleet and osquery. It uses the configuration files in this repository to run Fleet and the necessary dependencies in Docker.
Development
IMPORTANT:
- The
masterbranch is used byfleetctlbefore version 4.5.0 and should not change anymore except for critical fixes. - The main development and testing branch is
develop. - The release branch is
production.
To make changes to this repository:
Development
- Push a PR on a feature/bugfix branch, target branch should be
develop. - Test
fleetctl preview --preview-config <branch>with that branch, make sure everything works. - Once well tested and the PR is approved, merge PR to the
developbranch.
QA and Release
If there are no changes on the develop branch since last release, simply use: fleetctl preview.
If there are changes on the develop branch since last release:
- Test preview with
fleetctl preview --preview-config develop. - Once well tested, create a PR to merge
developto theproductionbranch at which point everyfleetctl preview(version 4.5+) user will retrieve it.