Software Inventory & Deployment

Relevant source files

The following files were used as context for generating this wiki page:

• tools/fleet-slackbot/system-prompt.js
• articles/deploy-software-packages.md
• cmd/fleetctl/fleetctl/generate_gitops.go
• articles/automatic-software-install-in-fleet.md
• articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md
• ee/maintained-apps/README.md
• articles/gitops-mode-software.md

Software Inventory & Deployment in Fleet provides a unified interface for managing application lifecycles across macOS, Windows, Linux, iOS, and Android endpoints. It encompasses automated visibility into installed packages, vulnerability detection based on version data, and cross-platform deployment mechanisms including custom packages and Fleet-maintained applications.

The system is designed to facilitate both manual interventions through the Fleet UI and automated workflows via GitOps or Policy-Driven Automation. By combining inventory data with deployment capabilities, Fleet allows administrators to ensure software consistency and remediate security vulnerabilities at scale.

Software Types and Management

Fleet categorizes software into three distinct types for management and deployment purposes. Each type has specific handling for metadata extraction and installation logic.

Software Type	Description	Platform Support
Fleet-maintained Apps (FMA)	Pre-configured apps provided by Fleet with automatic update tracking and verified scripts.	macOS, Windows
App Store (VPP) Apps	Applications sourced directly from the Apple App Store or Google Play Store.	iOS, iPadOS, Android
Custom Packages	User-uploaded installers or script-only packages.	macOS, Windows, Linux

Sources: articles/gitops-mode-software.md:5-7, articles/deploy-software-packages.md:7-9, ee/maintained-apps/README.md

Fleet-maintained Apps (FMA)

FMA utilizes Homebrew (macOS) and Winget (Windows) manifests to provide verified installation and uninstallation scripts. These apps are referenced in configuration via "slugs" (e.g., google-chrome/macos).
Sources: ee/maintained-apps/README.md:1-5, tools/fleet-slackbot/system-prompt.js:149-150

Custom Packages and Scripts

Fleet supports various installer formats. Metadata such as bundle identifiers, product codes, or package names are extracted during upload to enable inventory matching.

• Supported Formats: .pkg, .msi, .exe, .rpm, .deb, .ipa, .tar.gz, .sh, .ps1.
• Script-only Packages: .sh (Linux) and .ps1 (Windows) files are treated as the install script itself. They do not support separate pre/post-install scripts.
  Sources: articles/deploy-software-packages.md:21-23, 62-68

Software Deployment Architecture

Deployment in Fleet follows a structured flow involving the Fleet server, an S3-compatible storage bucket (for self-hosted environments), and the fleetd agent on the endpoint.

Deployment Process Flow

Fleet handles installer storage and distribution, while fleetd executes the localized installation logic.
Sources: articles/deploy-software-packages.md:12-16, 73-77

Deployment Logic and Retries

Software installations are automatically attempted up to 3 times (initial + 2 retries) to handle network intermittency. For policy-based installs, the retry count resets if the host subsequently passes the policy.
Sources: articles/automatic-software-install-in-fleet.md:28-30, articles/deploy-software-packages.md:104-106

Policy-Driven Automation

Fleet integrates software deployment with its policy engine to enable "self-healing" environments. When a host fails a specific policy (e.g., "Acrobat version is outdated"), Fleet can trigger a software installation automation.

Policy Automation Logic

Administrators can enable continuous_automations_enabled to retry installations on every failing result, though this carries a risk of retry loops if the installation does not resolve the policy failure.
Sources: articles/automatic-software-install-in-fleet.md:46-52

Pre-install and Post-install Hooks

• Pre-install Query: An osquery SQL statement that must return values for the install to proceed.
• Post-install Script: Runs after the installer. A non-zero exit code triggers an automatic uninstallation attempt by fleetd.
  Sources: articles/deploy-software-packages.md:73-77, 83-86

GitOps Integration

Fleet supports infrastructure-as-code via YAML configurations managed by fleetctl. When "GitOps mode" is enabled, UI changes are restricted to ensure the repository remains the source of truth.

Software YAML Schema

Software is defined within the software block of a fleet or global configuration file.

software:
  packages:
    - path: ../lib/macos/software/app.yml
      self_service: true
      setup_experience: false
  app_store_apps:
    - app_store_id: "12345"
      platform: darwin
  fleet_maintained_apps:
    - slug: google-chrome/macos
      install_script:
        path: ../lib/macos/software/chrome-install.sh

Sources: tools/fleet-slackbot/system-prompt.js:132-156, cmd/fleetctl/fleetctl/generate_gitops.go:1022-1035

GitOps State Generation

The generate-gitops command in fleetctl inspects the live Fleet environment to produce these YAML files, including the extraction of scripts and icons into a local library structure.
Sources: cmd/fleetctl/fleetctl/generate_gitops.go:215-225, 960-975

Vulnerability Reporting

Fleet correlates software inventory with vulnerability data (CVEs) to provide actionable security insights.

Prioritization Metrics

Fleet enhances standard CVE data with additional prioritization metrics to reduce alert fatigue:

• CVSS: Base severity score.
• EPSS (Exploit Prediction Scoring System): Estimating the probability of exploitation within 30 days.
• KEV (Known Exploited Vulnerabilities): CISA-managed list of vulnerabilities actively seen in the wild.

Sources: articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md:27-33, 115-120

Vulnerability Data Flow

Implementation Summary

The Software Inventory & Deployment system relies on the fleetd agent's ability to execute shell and PowerShell scripts, interact with local package managers (pkg, msi, deb, rpm), and report inventory changes back to the Fleet server. By leveraging both automated policies and GitOps, Fleet provides a scalable framework for managing thousands of endpoints across diverse operating systems.
Sources: articles/deploy-software-packages.md:12-16, articles/patch-management-and-vulnerability-reporting-for-linux-desktops.md:139-145