Host Visibility & Vitals
Relevant source files
The following files were used as context for generating this wiki page:
Host Visibility & Vitals refers to the system within Fleet that provides real-time and scheduled insights into the state of managed endpoints. This encompasses hardware inventory, software versions, system configurations, and security compliance metrics across various operating systems, including macOS, Windows, Linux, and ChromeOS.
The system relies on osquery to collect granular data, which is then processed by Fleet to provide high-level "vitals"—critical health and status indicators that allow IT and security teams to monitor thousands of hosts efficiently. This visibility is central to the platform's purpose of creating a transparent and open-source way to manage infrastructure.
Sources: handbook/company/README.md, website/scripts/build-static-content.js:37-45
Core Visibility Components
Fleet's visibility architecture is divided into several functional categories that track the computing lifecycle. These categories define how data is retrieved, summarized, and surfaced to users.
Vital Queries and Standard Library
Fleet maintains a standard library of queries, often referred to as "vitals," which are predefined SQL queries designed to extract critical information from hosts. These are categorized as built-in queries in the static content configuration. Unlike standard ad-hoc queries, vitals are intended to provide a baseline for host health and are automatically included in the application's configuration.
Sources: website/scripts/build-static-content.js:37-55, website/api/controllers/download-sitemap.js:83-93
Inventory and Reporting
The system provides comprehensive inventory capabilities, which are assessed for maturity across different stages of the product lifecycle.
| Category | Description | Maturity Level |
|---|---|---|
| Software Inventory | Tracks installed applications, browser extensions, and libraries. | 🦢 Lovable |
| Hardware Inventory | Collects details on CPU, memory, disk, and physical components. | 🦆 Complete |
| Device Status | Monitoring of online/offline status and general health. | 🦆 Complete |
| Vulnerability Detection | Identification of CVEs using NVD, CVSS, and EPSS data. | 🐥 Viable |
| Sources: handbook/company/product-maturity-assessment.md:65-80, website/api/controllers/view-security-and-control.js:80-90 |
Data Retrieval Logic
Host visibility is achieved through a combination of real-time "Live Queries" and scheduled collection.
Live Queries vs. Scheduled Queries
- Live Queries: Used for ad-hoc data gathering that Fleet does not already have in its datastore. This is typically used for investigating specific system configurations or incident response.
- Scheduled Queries: Automated collection at defined intervals to maintain a historical record of host state and inventory.
Sources: tools/fleet-slackbot/system-prompt.js:23-35, handbook/company/product-maturity-assessment.md:68-69
Retrieval Flow
The following diagram illustrates how the Fleet Assistant and system tools decide to retrieve host information.
This flow ensures that the system prefers aggregate and summary tools before drilling into individual host details, maintaining performance at scale.
Sources: tools/fleet-slackbot/system-prompt.js:15-50
Management and Vitals Processing
Vitals are processed and annotated using external data sources to provide context beyond raw osquery output. This is particularly evident in vulnerability management and security compliance.
Security and Vulnerability Visibility
Fleet detects and annotates CVEs (Common Vulnerabilities and Exposures) using several datasets:
- NVD/CVSS: For base severity scores.
- EPSS: To determine the probability of exploitation.
- CISA KEV: To identify vulnerabilities known to be exploited in the wild.
Sources: ee/vulnerability-dashboard/README.md:9-11, website/api/controllers/view-security-and-control.js:115-125
Host Platform Support
The visibility features vary in maturity across different operating systems. Fleet aims for "Market Competitive" status in monitoring across all major platforms.
Summary of Visibility Features
Visibility is structured into specific "stages" within the handbook to track enterprise readiness.
| Stage | Visibility Components | Maturity Target |
|---|---|---|
| Monitor | Software inventory, scheduled queries, activity feeds, and audit logs. | Market Competitive |
| Maintain | OS update status, patch management, and device health checks. | Enterprise Ready |
| Offboard | Remote wipe status and offboarding audit trails. | Core Capabilities Available |
| Sources: handbook/company/product-maturity-assessment.md:63-140 |
The visibility system is designed to provide "radical honesty" and technical precision, ensuring that IT teams have a clear view of their environment without marketing "spin" obscuring technical debt or system limitations.
Sources: handbook/marketing/fleet-ai-writing-instructions.md:12-16