Fleet osquery

Record your Fleet osquery connection as endpoint detection & response evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Fleet osquery:

   1. In Fleet, go to Settings › Users › Create user.
   2. Select the API-only option and name the user for Safeguard.
   3. Keep the role at Observer (the default access level for an API-only user).
   4. Or create the same user from the CLI after logging in to fleetctl as an admin: fleetctl user create --name 'API User' --api-only. Copy the token it prints ("The API token for your new user is: <TOKEN>"); it will not be shown again, but it can be retrieved later via the log in API.

   Where to find the other values:

   • Base URL (optional): The address of your Fleet server, the same one you use to open the Fleet UI.

   Fleet osquery shows the secret only once, so copy it before you leave the page.

   The fetched guide shows how the token is displayed only for the CLI flow; it does not say where the UI shows the token after you create an API-only user in Settings. An API-only user's key does not expire and the user has no Fleet UI access. Fleet Premium can further restrict an API-only user to a list of endpoints.

   Source: fleetdm.com, checked 2026-10-07.

2. On Compliance › Connectors, open Fleet osquery, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Fleet osquery yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks