Orbit & Fleetd Agent
Relevant source files
The following files were used as context for generating this wiki page:
Orbit is an open-source agent manager designed to install, update, and manage Fleet’s agents on end-user hosts. Its primary role is to handle the lifecycle of osquery and Fleet Desktop, ensuring that the desired configuration specified in the Fleet server is consistently applied across all endpoints. By acting as a wrapper, Orbit simplifies the deployment and maintenance of the security stack, moving away from manual agent management.
The "fleetd" agent represents the consolidated bundle managed by Orbit, which includes osquery and additional capabilities like Fleet-maintained tables and auto-update functionality. Orbit regularly communicates with the Fleet instance to retrieve the latest desired setup and adjusts the local host's agents to match that specification.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:1-12, handbook/marketing/fleet-ai-writing-instructions.md:37-37, articles/deploy-fleet-on-ubuntu-with-elastic.md:214-217
Architecture and Components
Orbit operates as a persistent management layer on the host, sitting between the Fleet server and the underlying security tools. It utilizes a secure update framework to pull binaries and configurations without requiring manual intervention from IT administrators.
Core Management Loop
Orbit maintains a continuous cycle of checking for updates and applying configurations. It uses a secure TUF (The Update Framework) server to verify and download updates for osquery and Fleet Desktop.
Orbit acts as the central coordinator on the endpoint, interacting with Fleet infrastructure to manage the local state of osquery and Fleet Desktop.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:8-12, articles/introducing-orbit-your-fleet-agent-manager.md:21-25
Component Summary
| Component | Description |
|---|---|
| Orbit | The agent manager that handles installation, updates, and configuration of osquery and Fleet Desktop. |
| osquery | The underlying instrumentation tool that allows querying the operating system as a relational database. |
| Fleet Desktop | A menu-bar application providing end-user transparency and self-service capabilities. |
| TUF Server | A secure update server providing the repository of signed binaries for Orbit to download. |
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:3-33, articles/deploy-fleet-on-ubuntu-with-elastic.md:214-217
Deployment and Package Generation
Orbit is typically deployed using a host-specific installer package. These packages are generated using the fleetctl command-line tool, which bakes in the necessary enrollment secrets and server URLs required for the host to communicate with the Fleet server.
Installer Creation Flow
The fleetctl package command creates platform-specific installers (e.g., .pkg for macOS, .msi for Windows, .deb/.rpm for Linux).
The sequence shows the process from package generation by an administrator to initial endpoint enrollment.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:14-19, website/scripts/build-static-content.js:1001-1015
Configuration Elements
Orbit's behavior can be customized during package generation or via GitOps workflows. Key configuration elements include:
- Enrollment Secret: Used to authenticate the agent during the initial join to the Fleet server.
- Server URL: The address of the Fleet server the agent should report to.
- Update Channels: Specifies whether Orbit should pull from
stable,edge, or specific pinned versions of agents. - Flag Management: Orbit can update osquery's command-line flags dynamically.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:14-27, tools/fleet-slackbot/system-prompt.js:111-135
Security and Update Framework
Security is a primary focus of Orbit, particularly regarding the delivery of updates. It utilizes The Update Framework (TUF) to ensure that binaries downloaded to the host are signed and have not been tampered with.
Update Mechanism Logic
Orbit checks for updates to itself, osquery, and Fleet Desktop. Administrators can choose to let Orbit automatically follow a release channel or pin specific versions to maintain environment stability.
The flow details the security verification and execution steps Orbit takes to update agents on a host.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:21-27, website/scripts/build-static-content.js:1001-1008
Integration with Fleetd and Osquery
Orbit enhances the standard osquery experience by providing "fleetd," which includes additional capabilities such as:
- Fleet-maintained Tables: Custom tables developed by Fleet to provide data not available in standard osquery.
- Dynamic Configuration: The ability to update osquery extensions and command-line flags without re-deploying the agent.
- End-user Transparency: Integration with Fleet Desktop to show users what data is being collected.
Sources: articles/introducing-orbit-your-fleet-agent-manager.md:3-8, articles/introducing-orbit-your-fleet-agent-manager.md:31-33, articles/deploy-fleet-on-ubuntu-with-elastic.md:214-217
Summary
Orbit serves as the critical lifecycle manager for Fleet's endpoint presence. By automating the installation and update processes for osquery and Fleet Desktop, it ensures that security teams can rely on a consistent and up-to-date fleet of agents. Its use of secure update protocols (TUF) and integration with fleetctl provides a robust, enterprise-ready solution for managing endpoint instrumentation at scale.