Security & Scaling

Relevant source files

The following files were used as context for generating this wiki page:

• ee/cis/CIS-BENCHMARKS.md
• ee/cis/prompt.md
• articles/tales-from-fleet-security-securing-google-workspace.md
• articles/tales-from-fleet-security-github-configuration-and-openssf-scorecards.md
• website/assets/resources/security-awareness/2022-05-security-awareness-slides.md
• tools/fleet-slackbot/system-prompt.js
• website/scripts/build-static-content.js

The Security and Scaling modules within Fleet focus on maintaining a robust security posture through automated compliance benchmarks, secure infrastructure configurations, and scalable information retrieval. The project leverages Center for Internet Security (CIS) benchmarks to enforce device compliance and utilizes advanced security integrations such as GitHub Scorecards and FIDO U2F hardware keys to protect development and organizational infrastructure.

Scaling is addressed through automated tools like the Fleet Slackbot and the static content build system, which allow for efficient management of large endpoint counts and high-volume information retrieval. These systems ensure that as the number of managed hosts grows, the performance of security audits and policy enforcement remains consistent across macOS, Windows, and Linux platforms.

Security Compliance & CIS Benchmarks

Fleet enforces security compliance by implementing CIS benchmarks as osquery policies. These benchmarks are organized by OS version and include automated queries that return rows when a device is compliant and zero rows when it is not. The system supports multiple platforms including macOS, Windows, and Linux.

CIS Policy Structure

Each CIS policy is defined in a YAML format containing specific metadata to track compliance IDs and levels.

Query Patterns for Compliance

Compliance queries follow specific architectural patterns to ensure accuracy:

• Direct Table Check: Inspects live state (e.g., checking if the firewall is enabled).
• Managed Policy Check: Verifies that a specific MDM profile is installed and that its values are not being overridden by local users.
• Negation Check: Ensures unauthorized services or files are absent.

Sources: ee/cis/CIS-BENCHMARKS.md:57-118

Pattern	Logic	Use Case
Direct	SELECT 1 FROM alf WHERE global_state >= 1;	Firewall state
Managed	EXISTS (good value) AND NOT EXISTS (conflicting value)	Software updates
Negation	SELECT 1 WHERE NOT EXISTS (subquery)	Disabling SSH

Sources: ee/cis/CIS-BENCHMARKS.md:59-95

Infrastructure Security

Fleet employs several layers of security for its own development and organizational infrastructure, focusing on identity management and repository integrity.

Identity and Access Management (IAM)

The project emphasizes FIDO U2F hardware security keys (e.g., Yubikeys) as the primary method for Two-Factor Authentication (2FA). This replaces less secure methods like SMS or TOTP. Fleet also utilizes Single Sign-On (SSO) across its SaaS tools (GitHub, Google Workspace, Slack) to centralize access control.

Sources: articles/tales-from-fleet-security-securing-google-workspace.md:39-55, website/assets/resources/security-awareness/2022-05-security-awareness-slides.md:58-86

GitHub Repository Security

Fleet uses OpenSSF Scorecards to automate security assessments of its primary repository. This includes:

• Enforced Code Reviews: Required for all changes to the main branch.
• Explicit Action Permissions: Limiting the scope of GitHub Actions to reduce the impact of potential compromises.
• Dependency Pinning: Using hashes for GitHub Actions and Dependabot for automated security updates.

Scaling Information Retrieval

To manage large-scale deployments, Fleet implements automated information retrieval systems and static content generators that minimize database load and improve response times.

Automated Fleet Assistant (Slackbot)

The Fleet Slackbot uses MCP (Model Context Protocol) tools to query live environments at scale. It follows an efficiency strategy to prevent overloading the server.

Tool Call Efficiency Rules:

• Start with aggregate/summary tools (get_total_system_count, get_aggregate_platforms).
• Avoid calling individual host details (get_host) for every host in a broad query.
• Cap tool calls at 12 or fewer per user request.

Sources: tools/fleet-slackbot/system-prompt.js:33-55

Static Content Build System

The build-static-content.js script scales the delivery of documentation and query libraries by pre-compiling Markdown and YAML into HTML partials. This reduces the need for real-time processing during website visits.

Scaling Policy Enforcement

Fleet handles scaling of policy enforcement through specialized tables and MDM profile delivery methods.

High-Performance Tables

Fleet uses custom "fleetd" tables for settings that stock osquery cannot efficiently read. These tables are optimized for performance across thousands of hosts.

Table	Purpose	Performance Note
find_cmd	Path-based file searching	Replaces slow file table walks for large scopes
authdb	Inspecting auth rules	Uses JSON extraction for efficiency
pmset	Power management	Parsed from nested JSON blobs

Sources: ee/cis/CIS-BENCHMARKS.md:131-155

MDM Scaling

When deploying configuration profiles to thousands of devices, Fleet uses managed_policies checks. The system handles "system-scope" vs "user-scope" keys to ensure that profiles scale correctly across shared or single-user machines. System-scoped keys (delivered with username = '') are preferred for global organization settings.

Sources: ee/cis/CIS-BENCHMARKS.md:75-90

Summary

Fleet’s approach to Security and Scaling is deeply integrated into its automation workflows. By codifying CIS benchmarks into osquery policies and enforcing hardware-backed identity management, the system maintains a high security bar. Scaling is achieved by shifting from real-time processing to aggregate summaries and static builds, ensuring that security visibility remains performant even as host counts grow into the tens of thousands.