Live query API for targeting multiple hosts

mikermcneil commented 2 weeks ago

@mikermcneil: As a user in the API, I want to do everything I can do in the UI, including (via one single API request) running a live query with arbitrary SQL against any of the hosts I can target with the query console's target picker.

@mikermcneil: This is core to Fleet.
- @rachaelshaw: today, live queries can only be run against 1 host at a time: https://fleetdm.com/docs/rest-api/rest-api#live-query-one-host-ad-hoc
- @noahtalerman: Users will expect to run a live query against many hosts at once, using the same targeting options they see in the Fleet UI.

noahtalerman commented 1 week ago

As a user in the API, I want to do everything I can do in the UI, including (via one single API request) running a live query with arbitrary SQL against any of the hosts I can target with the query console's target picker.

@rachaelshaw do we already have this API?

rachaelshaw commented 1 week ago

@noahtalerman ad-hoc queries can only be run against 1 host at a time (https://fleetdm.com/docs/rest-api/rest-api#live-query-one-host-ad-hoc)

noahtalerman commented 1 week ago

Problem

[CORE] As a user in the API, I want to do everything I can do in the UI, including (via one single API request) running a live query with arbitrary SQL against any of the hosts I can target with the query console's target picker.

What have you tried?

Everything else in the API, which currently fails to follow through on Fleet's brand promise to do everything in the API that you can do in the UI. We set out to solve this 2 years ago, but upon reflection (and actually trying to write code using it in a new app for the 3rd time since then), the solution we built doesn't satisfactorily solve the problem.

More on the problem here: https://github.com/fleetdm/fleet/blob/5c3d324d3d6a05bfa5dcbba8a2afe7fe7c06e6e8/website/scripts/test-llm-generated-sql.js#L124-L128

And here: https://github.com/mikermcneil/fleet-at-uber-via-sal-like-dashboard/blob/84660d0a10b4426261bd766400d72bbbaf2e7d5a/scripts/update-reports.js#L159-L218

Potential solutions

Change this (or introduce a new API, if absolutely necessary) to support running arbitrary SQL over the API against multiple hosts in a single request.

https://fleetdm.com/docs/rest-api/rest-api#run-live-query

What is the expected workflow as a result of your proposal?

As a user of the API, I can send a single API request to send arbitrary SQL as a live query for a particular platform. (i.e. because at least then I can simultaneously run that on all 4 platforms at once, with slightly different SQL)

fleetdm / fleet