fleetdm/fleet
Fleet
Fleet is an open-source device management platform that provides centralized control over computing devices running macOS, Linux, Windows, Chromebooks, iOS, and Android. It enables organizations to enroll devices, collect real-time telemetry, enforce security compliance policies, and manage software remotely from a single system. The platform can be deployed as a single binary, run locally for testing, or scaled horizontally across cloud infrastructure on AWS, Kubernetes, GCP, or Render, with support for high availability through database replication and load balancing.
The platform distinguishes itself through its infrastructure-as-code approach, allowing teams to manage device configurations, policies, and queries declaratively through GitOps workflows, a REST API, webhooks, or the fleetctl command-line tool. Every configuration change is tracked and auditable, with the ability to review and approve proposed modifications before deployment and instantly roll back if needed. Fleet integrates with common identity providers through SAML single sign-on, supports SCIM for automatic user provisioning and deprovisioning, and can export data to enterprise platforms like Snowflake, Splunk, GitHub Actions, and Jira for workflow automation.
Fleet provides comprehensive device monitoring and security assessment capabilities, including live SQL queries across all managed devices, automated vulnerability scanning, CIS benchmark compliance checks, and YARA rule-based file scanning. The platform collects detailed device health data, software inventory, and security configurations, and can run scripts automatically based on schedules or policy triggers. It supports remote software deployment, including App Store applications on Apple devices, and enforces security controls such as disk encryption and custom compliance policies. The platform exposes Prometheus metrics and OpenTelemetry traces for observability, and provides a health endpoint for monitoring server status.
Features
- Multi-Mode Deployments - Offers multiple deployment modes including single binary, local testing, and cloud infrastructure.
- Device Management and Deployment - Installs, updates, and removes software on managed devices without physical access or user intervention.
- Mobile Device Management Platforms - Handles mobile device management, patching, and software deployment over the air for all managed devices.
- MySQL Storage Support - Stores all Fleet data in a MySQL database with support for read replicas and failover.
- Device SQL Query Executors - Executes stored osquery SQL questions against all hosts to collect specific data and surface security issues.
- Change Tracking - Records every configuration change made to the fleet, enabling rollback and repeatable deployments.
- Software Deployment Tools - Installs, updates, and removes applications across managed devices from a central catalog.
- Cloud Infrastructure Deployment - Deploys the Fleet device management platform on AWS, Kubernetes, GCP, or Render.
- Configuration Approval Gates - Requires human review and approval before configuration changes are deployed to managed devices.
- Configuration as Code - Applies configuration changes declaratively so every state is repeatable and auditable.
- Auditable Configuration Histories - Tracks every configuration change, enables rollback of errors, and repeats successful deployments through code.
- Multi-Interface Management - Provides graphical, API, and infrastructure-as-code interfaces for managing device configurations.
- Cloud or Self-Hosted Deployments - Provides the same feature set whether hosted by the vendor or deployed on private infrastructure.
- Infrastructure as Code Practices - Manages device configurations and fleet policies programmatically using infrastructure-as-code practices.
- CLI Fleet Controllers - Controls a Fleet deployment, runs live queries, and integrates with logging and alerting infrastructure using the fleetctl command-line tool.
- Declarative Fleet Governance - Governs device configurations and workflows using infrastructure-as-code, a REST API, webhook events, or a command-line tool.
- Single-Binary Deployments - Deploys the entire Fleet application as a single static binary with all components included.
- Multi-Interface Fleet Configuration - Manages device settings and policies through GitOps workflows, a graphical interface, a REST API, webhooks, or a command-line tool.
- Device Health Diagnostics - Collects data on user accounts, device health, installed software, and security settings to manage devices.
- Device Management APIs - Manages hosts, queries, policies, and configuration through a REST API to build custom dashboards and automation.
- iOS Device Management - Manages devices across multiple platforms including iOS, Android, and desktop operating systems.
- Cross-Platform Device Managers - Provides a unified platform to manage macOS, Linux, Windows, Chromebooks, iOS, and Android devices.
- Live SQL Queries - Ships live SQL querying across all managed devices as a primary monitoring capability.
- Security Benchmarking - Evaluates device configurations against CIS benchmarks using policy queries to identify compliance gaps.
- Device Posture Validation - Validates device compliance against CIS benchmarks and reports security posture.
- Security and Compliance - Enforces security compliance policies by querying devices and reporting pass/fail status.
- Configuration Enforcement - Enforces software and configuration policies across managed devices to maintain compliance.
- Device Registration - Registers computing devices into the management platform for centralized monitoring and control.
- Vulnerability Scanning - Scans managed devices for known vulnerabilities and flags them for remediation.
- Compliance Evidence Collection - Automatically checks device configurations against organizational policies to collect audit evidence.
- Device State Collection - Deploys osquery and Orbit agents to gather real-time state information from every device across the fleet.
- Fleet Device Report Generators - Collects live diagnostics and status data from every device to provide up-to-date visibility into the fleet.
- Remote Device Management - Controls laptops and mobile devices from a central platform to enforce policies without physical access.
- Software Inventory Management - Lists all installed software on each host with detected vulnerabilities and enables remote installation.
- Patch Management - Catalogs installed applications across devices and pushes updates to keep software current and secure.
- OS and Hardware Data Queries - Queries operating system, hardware, and software data from devices using osquery tables for analysis and filtering.
- Horizontal Server Scaling - Runs multiple Fleet server processes behind a load balancer to handle hundreds of thousands of hosts.
- External Platform Connectors - Connects Fleet with external platforms like ticketing systems, data lakes, and automation tools through webhooks, APIs, and identity providers.
- YARA Rule Execution - Applies YARA signatures to managed devices for continuous file monitoring and threat detection.
- Query Result Caching - Queues and caches distributed query results using Redis for ingestion and processing.
- SQLite Query Interfaces - Treats local SQLite databases as osquery tables for live querying across managed devices.
- Custom Workflow Builders - Provides GUI, REST API, webhook events, MCP server, and CLI to build custom workflows and integrate with common tools.
- Device Agent Settings - Updates fleetd agent settings across all hosts via the UI, API, or YAML files to control performance and check-in behavior.
- Scheduled Script Executions - Executes custom scripts on devices based on schedule or policy triggers without manual intervention.
- Third-Party Service Integrations - Connects Fleet to third-party services through APIs and extensions to fit existing workflows.
- Webhook-Triggered Workflows - Sends outbound event notifications for host, policy, or vulnerability changes to trigger actions in external systems.
- Change Rollback Mechanisms - Applies approved changes across all devices with instant rollback capability.
- Platform-Specific Config Overrides - Provides per-platform osquery configuration overrides for hosts grouped by operating system.
- Database High Availability - Uses highly available MySQL with read replicas and failover to maintain uptime.
- Traffic Load Balancers - Distributes request traffic over multiple Fleet instances using a load balancer.
- Host Health Dashboards - Displays key device information collected by built-in queries, giving a quick overview of each host's state.
- Apple App Store Deployments - Pushes App Store applications to managed Apple devices using the platform's distribution mechanism.
- Full Disk Encryption - Enforces disk encryption on managed devices and reports compliance status.
- Identity Providers - Integrates any SAML-compatible identity provider for authentication and access control.
- Multi-Source Enrollment - Adds endpoints from subsidiaries, partners, or acquisitions without requiring tool migration.
- Team-Targeted Deployments - Deploys CIS benchmark policies to designated device teams via fleetctl and API.
- SAML SSO Integrations - Configures SAML-based single sign-on with any generic identity provider.
- SCIM Provisioning - Automatically deprovisions user accounts when they are removed from the identity provider via SCIM.
- SSL/TLS Connection Security - Encrypts osquery agent connections using TLS to secure device management traffic.
- External User Provisioning - Automatically creates user accounts on first SSO login, copying identity from the IdP.
- Agent - Pins agent component versions via TUF auto-update channels for controlled rollouts.
- Security Tool Integrations - Integrates with common security and IT tools through ready-to-use integrations to streamline workflows.
- Audit Log Exports - Exports real-time query results and audit logs for security and compliance analysis.
- Prometheus Exporters - Exposes server metrics in Prometheus format for monitoring and integration with graphing tools like Grafana.
- Linux Device Managers - Applies remote management, reporting, and security controls to Linux machines alongside other OSes.
- Device Status Indicators - Places a menu bar icon on enrolled devices so users can see their machine's security and compliance status.
- Configuration Management - Telemetry platform for managing server and workstation security data.
- Incident Response Platforms - Host monitoring platform leveraging osquery for security visibility.
