Fleet (software)

Fleet (software)
Name	Fleet
Developer	Kolide
Released	2014
Programming language	Go, JavaScript
Platform	Cross-platform
License	Apache License 2.0

Fleet (software) is an open-source endpoint visibility and management system for macOS, Linux, and Windows that uses the osquery framework to perform SQL-like queries against host telemetry and configuration. It combines distributed query scheduling, centralized logging, and policy enforcement to support incident response, vulnerability management, and compliance monitoring across fleets of devices. Fleet is maintained by a mix of corporate contributors and independent developers, and it integrates with many security and observability platforms.

Overview

Fleet provides real-time and historical telemetry collection for large-scale inventories of endpoints, enabling security operations, incident response teams, and compliance auditors to query endpoint state using declarative SQL queries. It builds on osquery, leverages components from GRPC-based services, and integrates with telemetry sinks such as Elasticsearch, Splunk, Sentry, Datadog, and Prometheus. Adopted by organizations ranging from startups to enterprises, Fleet supports use cases also addressed by vendors like CrowdStrike, Carbon Black, Palo Alto Networks, Microsoft, and Cisco. The project aligns with standards and practices promoted by communities such as OpenSSF, OWASP, and CNCF.

Architecture and Components

Fleet’s architecture separates concerns into backend services, frontend UI, and host agents. The host agent is typically an instance of osquery that reports via TLS to Fleet’s backend, which exposes APIs consumed by a React-based frontend and CLI tooling. Core components include the Fleet Server, enroller, and scheduler, integrating with identity providers such as Okta, Azure Active Directory, Google Workspace, and LDAP directories. Storage backends supported include PostgreSQL, MySQL, and cloud services from Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Fleet also interoperates with orchestration tools like Kubernetes, Ansible, Terraform, and HashiCorp Vault for secret management. Telemetry pipeline integrations enable export to observability platforms like Grafana, InfluxDB, and New Relic.

Features and Functionality

Fleet enables ad hoc and scheduled queries, packs of reusable queries, distributed query campaign management, host grouping, and role-based access control. Features mirror capabilities found in product lines from Splunk Enterprise Security, Elastic Security, Tanium, and SentinelOne, while offering open-source extensibility akin to TheHive Project and MISP. Fleet supports live query responses, result aggregation, and artifact collection for forensic workflows used by teams aligned with frameworks such as MITRE ATT&CK, NIST SP 800-53, ISO/IEC 27001, and CIS Benchmarks. Automation features integrate with ticketing systems like Jira, ServiceNow, and Zendesk, and alerting systems such as PagerDuty and Opsgenie. The UI provides dashboards, host detail pages, and query builders influenced by UX patterns from Kibana and Grafana.

Deployment and Integration

Fleet can be deployed on-premises, in virtual private clouds, or as managed services alongside tools from HashiCorp, Red Hat, and Canonical. Deployment patterns include containerized deployments using Docker and orchestration via Kubernetes with Helm charts and operators. CI/CD pipelines for Fleet updates commonly integrate with GitHub Actions, GitLab CI, Jenkins, and CircleCI. Integration points include identity federation with SAML 2.0 providers, secrets retrieval from AWS Secrets Manager and Azure Key Vault, and log forwarding to Fluentd or Logstash. Enterprise deployments often use load balancers from F5 Networks or NGINX and observability stacks built around Prometheus and Grafana for service-level metrics.

Security and Compliance

Security features include encrypted communication using TLS, mutual authentication with PKI, granular RBAC, and audit logging suitable for compliance with mandates like HIPAA, PCI DSS, SOC 2, and GDPR. Fleet’s use of osquery enables detection of Indicators of Compromise cataloged in threat intelligence feeds such as VirusTotal, MISP, and AlienVault OTX. Hardening recommendations mirror guidance from CIS and NIST, and vendors in the ecosystem provide integrations for endpoint isolation and remediation alongside platforms such as VMware, Citrix, and Fortinet. Forensics workflows export artifacts compatible with tools like Volatility, Autopsy, and FTK, and incident responders commonly correlate Fleet data with SIEM platforms including QRadar and Splunk Enterprise.

Development and Community

Fleet’s development is driven by contributors from companies, security researchers, and open-source maintainers. The project is hosted on collaborative platforms used by communities such as GitHub, with issue tracking, pull requests, and CI provided by services including Travis CI and CircleCI. Documentation and advocacy are shared through channels like Slack, Discourse, and conferences such as DEF CON, Black Hat, RSA Conference, and SANS Institute events. Commercial support and managed offerings are provided by firms in the open-source ecosystem and by enterprise vendors that contribute to related projects such as osquery and Kolide-related initiatives. Users and contributors coordinate around roadmaps, security advisories, and governance models backed by organizations like Linux Foundation and community groups focused on endpoint detection.

Category:Free security software Category:Open-source security software Category:Endpoint security