Meta pixel

Fleet documentation

Welcome to the documentation for Fleet, the lightweight management platform for laptops and servers.

search

Can't find what you're looking for? Support

{{page.title}}

Vulnerability processing

Edit page

Vulnerability processing

Introduction

Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts.

To see what software is covered, check out the Coverage section.

Learn more about how it works for different platforms.

Coverage

Fleet detects vulnerabilities for these software types:

Type macOS Windows Linux
Apps
Browser plugins Chrome extensions, Firefox extensions Chrome extensions, Firefox extensions
Packages Python, Homebrew Python, Atom, Chocolatey Adhere to whatever is defined in the OVAL definitions, except for kernel vulnerabilities and vulnerabilities involving configuration files. Supported distributions:
  • Ubuntu
  • RHEL based distros (Red Hat, CentOS, Fedora, and Amazon Linux)

As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches.

Configuration

When upgrading to Fleet 4.7.0 or later, vulnerability processing is automatically enabled if vulnerability processing and software inventory are not explicitly disabled.

If you explicitly disabled vulnerability processing, and now would like to enable this feature, first enable the software inventory feature by setting the following app config:

---
apiVersion: v1
kind: config
spec:
  features:
    enable_software_inventory: true

Then, enable vulnerability processing by specifying a path where Fleet will download the different data feeds. This can be done by setting the following app config:

---
apiVersion: v1
kind: config
spec:
  vulnerabilities:
    databases_path: /some/path

Or through environment variables:

FLEET_VULNERABILITIES_DATABASES_PATH=/some/path

The path specified needs to exist and Fleet needs to be able to read and write to and from it. This is the only mandatory configuration needed for vulnerability processing to work. Additional options, like vulnerability check frequency, can be found in the configuration documentation.

You'll need to restart the Fleet instances after changing these settings.

Advanced configuration

Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful for frictionless deployments and is well suited for most use cases. However, in larger deployments, where there can be dozens of Fleet server replicas sitting behind a load balancer, it is desirable to manage vulnerability processing externally.

The reasons for this are as follows:

  • lower resource requirements across the entire Fleet server deployment (as vulnerability processing requires considerably more resources than just running Fleet server alone)
  • more control over scheduling constraints (only process during windows of low utilization, etc.)

It is possible to limit vulnerability processing to a single dedicated host, by setting current_instance_checks to no but still run one Fleet server as yes, but the drawback here is still having to dedicate resources for this single host 24/7. The Fleet binary has a command which handles the same vulnerability processing, but will exit (successfully with 0) on completion. Using this sub-command we can delegate vulnerability processing to external systems such as:

To opt into this functionality, be sure to configure your Fleet server deployment with

FLEET_VULNERABILITIES_DISABLE_SCHEDULE=true

which will disable the internal scheduling mechanism for vulnerability processing.

And then externally run with the same environment variables/configuration files passed to the server command.

fleet vuln_processing

Did we miss anything?

If you notice something we've missed or could be improved on, please follow this link and submit a pull request to the Fleet repo.

An arrow pointing upBack to top