clong / DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices
MIT License
4.57k stars 978 forks source link

No devices enrolled in fleet #874

Open Scr1ptK1dd1e opened 1 year ago

Scr1ptK1dd1e commented 1 year ago

Please verify that you are building from an updated Master branch before filing an issue.

Description of the issue:

While I have access to all the services in logger and things seem to be running fine I.E. Guacamole, Splunk, Fleet web UI are accessible and Splunk is getting data, there are no machines enrolled with fleet. I don't recall any errors in the vagrant deployment related to fleet but when I try to run the command produced with the add-host button in fleet, the command is not found on the DC machine so I assume it was not installed properly? image

I had some issues with configuring the shares, networking and installing VMWare tools which I eventually corrected manually by setting static IP for my VMNet 2 adapter, running VMWare tools installer as NT System on affected windows machines and reprovisioning with vagrant to pass all checks from post_build_checks.sh. I understand machines can be enrolled with only osquery and I'm wondering if I should even be trying to download the fleetctl installer to run the command or if there's some way I should be trying to enroll them with OSQuery?

Link to Gist Containing Build Logs:

I don't have any vagrantup$host.log files to post.