FleetDM

Collect activity audit logs from your Fleet instance to monitor device management actions, software installs, and administrative changes.

Ingest Methods

RunReveal offers the following ways to ingest FleetDM logs:

• API Polling

API Polling

RunReveal polls the Fleet activities API (GET /api/v1/fleet/activities) every 5 minutes using a Fleet API token. On the first poll, RunReveal backfills the last 24 hours of activity; subsequent polls fetch only new events.

To connect Fleet you need two things: your Fleet URL and a Fleet API token.

Step 1: Get a Fleet API token

Create an API-only user and copy its token using either the Fleet UI or fleetctl:

Fleet UI

1. In Fleet, go to Settings → Users
2. Click Create user
3. Select the API-only user option and give it a name (e.g. RunReveal)
4. The user only needs read access to activities — the default Observer role is sufficient
5. Create the user, then copy the generated API token (it is shown only once)

fleetctl (requires admin)

fleetctl user create --name 'RunReveal' --api-only

Press any key when prompted to reveal the token, then copy it. You can retrieve the token again later via the login API.

Step 2: Add the source in RunReveal

1. Go to Sources in RunReveal
2. Click the FleetDM source tile
3. Give it a Source Name
4. Enter your Fleet URL — the base URL of your Fleet instance (self-hosted or managed cloud), e.g. https://your-fleet-instance.com
5. Paste the API Token from Step 1
6. Click Connect Source

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.