> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fleet

> Reference for the Tracecat Fleet integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Count hosts

Action ID: `tools.fleetdm.count_hosts`

Count hosts matching the given filters without returning host records.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#count-hosts](https://fleetdm.com/docs/rest-api/rest-api#count-hosts)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope the count to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="low_disk_space" type="integer | null">
  Only count hosts with less than this many GB of disk space.

  Default: `null`.
</ParamField>

<ParamField path="mdm_enrollment_status" type="string | null">
  MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).

  Default: `null`.
</ParamField>

<ParamField path="os_settings_disk_encryption" type="string | null">
  Disk encryption status filter (verified, verifying, action\_required, enforcing, failed, removing\_enforcement).

  Default: `null`.
</ParamField>

<ParamField path="policy_id" type="integer | null">
  Filter by hosts evaluated against this policy ID (pair with policy\_response).

  Default: `null`.
</ParamField>

<ParamField path="policy_response" type="string | null">
  Policy compliance filter for policy\_id (passing or failing).

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against hostname, IP, serial, and UUID.

  Default: `null`.
</ParamField>

<ParamField path="software_version_id" type="integer | null">
  Only count hosts that have this software version installed.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  Host status filter (online, offline, new, mia, missing).

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="string | null">
  Only count hosts affected by this CVE (e.g. CVE-2024-1234).

  Default: `null`.
</ParamField>

## Create global policy

Action ID: `tools.fleetdm.create_global_policy`

Create a global compliance policy from an osquery SQL check.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#create-policy](https://fleetdm.com/docs/rest-api/rest-api#create-policy)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="name" type="string" required>
  Name of the policy.
</ParamField>

<ParamField path="query" type="string" required>
  The osquery SQL statement that hosts must satisfy to pass.
</ParamField>

<ParamField path="critical" type="boolean | null">
  Mark the policy as critical (Fleet Premium).

  Default: `null`.
</ParamField>

<ParamField path="description" type="string | null">
  Human-readable description of the policy.

  Default: `null`.
</ParamField>

<ParamField path="platform" type="string | null">
  Comma-separated platforms the policy targets (e.g. darwin,windows,linux).

  Default: `null`.
</ParamField>

<ParamField path="resolution" type="string | null">
  Remediation guidance shown for failing hosts.

  Default: `null`.
</ParamField>

## Create report

Action ID: `tools.fleetdm.create_report`

Create a saved report (saved query) in Fleet.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#create-report](https://fleetdm.com/docs/rest-api/rest-api#create-report)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="name" type="string" required>
  Name of the saved report.
</ParamField>

<ParamField path="query" type="string" required>
  The SQL query the report collects data with.
</ParamField>

<ParamField path="description" type="string | null">
  Human-readable description of the report.

  Default: `null`.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Fleet (team) ID to scope the report to.

  Default: `null`.
</ParamField>

<ParamField path="interval" type="integer | null">
  Schedule interval in seconds (0 or null for an unscheduled report).

  Default: `null`.
</ParamField>

<ParamField path="platform" type="string | null">
  Comma-separated platforms the report targets (e.g. darwin,windows,linux).

  Default: `null`.
</ParamField>

## Delete host

Action ID: `tools.fleetdm.delete_host`

Delete a host from Fleet by its numeric ID.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#delete-host](https://fleetdm.com/docs/rest-api/rest-api#delete-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Get disk encryption summary

Action ID: `tools.fleetdm.get_disk_encryption_summary`

Get aggregate disk encryption (FileVault and BitLocker) status counts by OS.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-disk-encryption-status](https://fleetdm.com/docs/rest-api/rest-api#get-disk-encryption-status)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope the summary to a fleet (team) ID.

  Default: `null`.
</ParamField>

## Get global policy

Action ID: `tools.fleetdm.get_global_policy`

Get a single global policy including its pass and fail host counts.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-policy](https://fleetdm.com/docs/rest-api/rest-api#get-policy)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="policy_id" type="integer" required>
  Numeric Fleet policy ID.
</ParamField>

## Get host

Action ID: `tools.fleetdm.get_host`

Get full details for a single host by its numeric Fleet ID.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-host](https://fleetdm.com/docs/rest-api/rest-api#get-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

<ParamField path="exclude_fleet_maintained_policies" type="boolean | null">
  If true, omit Fleet-maintained policies from the host's policy list.

  Default: `null`.
</ParamField>

<ParamField path="exclude_software" type="boolean | null">
  If true, omit the host's installed software from the response.

  Default: `null`.
</ParamField>

## Get host activities

Action ID: `tools.fleetdm.get_host_activities`

List the past activity audit trail for a single host.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Activities per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

## Get host by identifier

Action ID: `tools.fleetdm.get_host_by_identifier`

Get full details for a single host by hostname, UUID, serial, or node key.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-host-by-identifier](https://fleetdm.com/docs/rest-api/rest-api#get-host-by-identifier)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="identifier" type="string" required>
  Host hostname, UUID, hardware serial, osquery host ID, or node key.
</ParamField>

<ParamField path="exclude_fleet_maintained_policies" type="boolean | null">
  If true, omit Fleet-maintained policies from the host's policy list.

  Default: `null`.
</ParamField>

<ParamField path="exclude_software" type="boolean | null">
  If true, omit the host's installed software from the response.

  Default: `null`.
</ParamField>

## Get host configuration profiles

Action ID: `tools.fleetdm.get_host_configuration_profiles`

Get the OS settings and configuration profiles applied to a host.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-os-settings-configuration-profile](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-os-settings-configuration-profile)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Get host encryption key

Action ID: `tools.fleetdm.get_host_encryption_key`

Get a host's disk encryption recovery key (FileVault or BitLocker).

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-disk-encryption-key](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-disk-encryption-key)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Get host MDM

Action ID: `tools.fleetdm.get_host_mdm`

Get the MDM enrollment status and server URL for a host.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-mobile-device-management-mdm-information](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-mobile-device-management-mdm-information)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Get host summary

Action ID: `tools.fleetdm.get_host_summary`

Get aggregate host counts grouped by status and platform.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-summary](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-summary)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope the summary to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="low_disk_space" type="integer | null">
  Count hosts with less than this many GB of disk space.

  Default: `null`.
</ParamField>

<ParamField path="platform" type="string | null">
  Platform filter (darwin, windows, linux, chrome, ios, ipados).

  Default: `null`.
</ParamField>

## Get MDM command results

Action ID: `tools.fleetdm.get_mdm_command_results`

Get the execution results and status for a previously enqueued MDM command.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-mdm-command-results](https://fleetdm.com/docs/rest-api/rest-api#get-mdm-command-results)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="command_uuid" type="string" required>
  UUID of the MDM command returned when it was enqueued.
</ParamField>

## Get OS settings summary

Action ID: `tools.fleetdm.get_os_settings_summary`

Get aggregate OS settings status counts (verified, verifying, pending, failed).

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-os-settings-configuration-profiles-status](https://fleetdm.com/docs/rest-api/rest-api#get-os-settings-configuration-profiles-status)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope the summary to a fleet (team) ID.

  Default: `null`.
</ParamField>

## Get report

Action ID: `tools.fleetdm.get_report`

Get a single saved report (saved query) by its ID.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-report](https://fleetdm.com/docs/rest-api/rest-api#get-report)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="report_id" type="integer" required>
  Numeric Fleet report ID.
</ParamField>

## Get report data

Action ID: `tools.fleetdm.get_report_data`

Get the most recent saved (scheduled) results for a report.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-report-data](https://fleetdm.com/docs/rest-api/rest-api#get-report-data)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="report_id" type="integer" required>
  Numeric Fleet report ID.
</ParamField>

## Get software title

Action ID: `tools.fleetdm.get_software_title`

Get a single software title with its versions, vulnerabilities, and host counts.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-software](https://fleetdm.com/docs/rest-api/rest-api#get-software)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="software_title_id" type="integer" required>
  Numeric Fleet software title ID.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope host counts to a fleet (team) ID.

  Default: `null`.
</ParamField>

## Get vulnerability

Action ID: `tools.fleetdm.get_vulnerability`

Get details for a single CVE including affected software, CVSS, EPSS, and CISA status.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-vulnerability](https://fleetdm.com/docs/rest-api/rest-api#get-vulnerability)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="cve" type="string" required>
  CVE identifier (e.g. CVE-2024-1234).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope affected hosts and software to a fleet (team) ID.

  Default: `null`.
</ParamField>

## List activities

Action ID: `tools.fleetdm.list_activities`

List the global audit log of actions performed in Fleet.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-activities](https://fleetdm.com/docs/rest-api/rest-api#list-activities)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="order_direction" type="string | null">
  Sort direction (asc or desc).

  Default: `null`.
</ParamField>

<ParamField path="order_key" type="string | null">
  Field to order by (e.g. created\_at).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Activities per page.

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against actor name and email.

  Default: `null`.
</ParamField>

## List configuration profiles

Action ID: `tools.fleetdm.list_configuration_profiles`

List the MDM configuration profiles defined in Fleet.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-configuration-profiles](https://fleetdm.com/docs/rest-api/rest-api#list-configuration-profiles)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope profiles to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Profiles per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

## List fleet policies

Action ID: `tools.fleetdm.list_fleet_policies`

List the compliance policies scoped to a single fleet (team).

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-fleet-level-policies](https://fleetdm.com/docs/rest-api/rest-api#list-fleet-level-policies)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer" required>
  Numeric Fleet (team) ID.
</ParamField>

<ParamField path="merge_inherited" type="boolean | null">
  Include global policies inherited by the fleet.

  Default: `null`.
</ParamField>

## List fleets

Action ID: `tools.fleetdm.list_fleets`

List fleets (teams) used to scope hosts, policies, and queries.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-fleets](https://fleetdm.com/docs/rest-api/rest-api#list-fleets)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Fleets per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against fleet name.

  Default: `null`.
</ParamField>

## List global policies

Action ID: `tools.fleetdm.list_global_policies`

List global compliance policies with their passing and failing host counts.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-policies](https://fleetdm.com/docs/rest-api/rest-api#list-policies)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="order_direction" type="string | null">
  Sort direction (asc or desc); requires order\_key.

  Default: `null`.
</ParamField>

<ParamField path="order_key" type="string | null">
  Field to order policies by (e.g. name, failing\_host\_count).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Policies per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

## List host software

Action ID: `tools.fleetdm.list_host_software`

List the software installed on a host along with detected vulnerabilities.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#get-hosts-software](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-software)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

<ParamField path="exploit" type="boolean | null">
  Only include software with a CISA known-exploited vulnerability.

  Default: `null`.
</ParamField>

<ParamField path="max_cvss_score" type="number | null">
  Only include software with a vulnerability at or below this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="min_cvss_score" type="number | null">
  Only include software with a vulnerability at or above this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Software entries per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against software name.

  Default: `null`.
</ParamField>

<ParamField path="vulnerable" type="boolean | null">
  Only include software with known vulnerabilities.

  Default: `null`.
</ParamField>

## List hosts

Action ID: `tools.fleetdm.list_hosts`

List and search hosts enrolled in Fleet with server-side filters.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-hosts](https://fleetdm.com/docs/rest-api/rest-api#list-hosts)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="low_disk_space" type="integer | null">
  Only include hosts with less than this many GB of disk space.

  Default: `null`.
</ParamField>

<ParamField path="mdm_enrollment_status" type="string | null">
  MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).

  Default: `null`.
</ParamField>

<ParamField path="order_direction" type="string | null">
  Sort direction (asc or desc); requires order\_key.

  Default: `null`.
</ParamField>

<ParamField path="order_key" type="string | null">
  Column to sort hosts by.

  Default: `null`.
</ParamField>

<ParamField path="os_name" type="string | null">
  Operating system name filter (must be paired with os\_version).

  Default: `null`.
</ParamField>

<ParamField path="os_settings_disk_encryption" type="string | null">
  Disk encryption status filter (verified, verifying, action\_required, enforcing, failed, removing\_enforcement).

  Default: `null`.
</ParamField>

<ParamField path="os_version" type="string | null">
  Operating system version filter (must be paired with os\_name).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Hosts per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="policy_id" type="integer | null">
  Filter by hosts evaluated against this policy ID (pair with policy\_response).

  Default: `null`.
</ParamField>

<ParamField path="policy_response" type="string | null">
  Policy compliance filter for policy\_id (passing or failing).

  Default: `null`.
</ParamField>

<ParamField path="populate_policies" type="boolean | null">
  Include each host's policy compliance in the response.

  Default: `null`.
</ParamField>

<ParamField path="populate_software" type="boolean | null">
  Include each host's installed software in the response.

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against hostname, IP, serial, and UUID.

  Default: `null`.
</ParamField>

<ParamField path="software_version_id" type="integer | null">
  Only include hosts that have this software version installed.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  Host status filter (online, offline, new, mia, missing).

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="string | null">
  Only include hosts affected by this CVE (e.g. CVE-2024-1234).

  Default: `null`.
</ParamField>

## List hosts by vulnerability

Action ID: `tools.fleetdm.list_hosts_by_vulnerability`

List the hosts affected by a specific CVE.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-hosts](https://fleetdm.com/docs/rest-api/rest-api#list-hosts)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="cve" type="string" required>
  CVE identifier to filter affected hosts by (e.g. CVE-2024-1234).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Hosts per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="status" type="string | null">
  Host status filter (online, offline, new, mia, missing).

  Default: `null`.
</ParamField>

## List hosts in label

Action ID: `tools.fleetdm.list_label_hosts`

List the hosts that are members of a given label.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-labels-hosts](https://fleetdm.com/docs/rest-api/rest-api#list-labels-hosts)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="label_id" type="integer" required>
  Numeric Fleet label ID.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Hosts per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against hostname, IP, serial, and UUID.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  Host status filter (online, offline, new, mia, missing).

  Default: `null`.
</ParamField>

## List labels

Action ID: `tools.fleetdm.list_labels`

List all labels defined in Fleet, including built-in platform labels.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-labels](https://fleetdm.com/docs/rest-api/rest-api#list-labels)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="order_key" type="string | null">
  Field to order labels by (e.g. name, created\_at).

  Default: `null`.
</ParamField>

## List MDM commands

Action ID: `tools.fleetdm.list_mdm_commands`

List MDM commands issued to a host, optionally filtered by request type and status.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-mdm-commands](https://fleetdm.com/docs/rest-api/rest-api#list-mdm-commands)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_identifier" type="string" required>
  Host hostname, UUID, or hardware serial to scope commands to (required by Fleet; omitting it is deprecated and removed in Fleet 5).
</ParamField>

<ParamField path="command_status" type="string | null">
  Filter by command status (ran, pending, failed).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Commands per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="request_type" type="string | null">
  Filter by MDM command request type (e.g. DeviceLock, EraseDevice).

  Default: `null`.
</ParamField>

## List OS versions

Action ID: `tools.fleetdm.list_os_versions`

List operating system versions across hosts with detected vulnerabilities.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-operating-systems](https://fleetdm.com/docs/rest-api/rest-api#list-operating-systems)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  OS versions per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="platform" type="string | null">
  Platform filter (darwin, windows, linux, chrome).

  Default: `null`.
</ParamField>

## List policy hosts

Action ID: `tools.fleetdm.list_policy_hosts`

List the hosts that pass or fail a given policy.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-hosts](https://fleetdm.com/docs/rest-api/rest-api#list-hosts)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="policy_id" type="integer" required>
  Numeric Fleet policy ID.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Hosts per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="policy_response" type="string">
  Compliance filter (passing or failing).

  Default: `"failing"`.
</ParamField>

## List reports

Action ID: `tools.fleetdm.list_reports`

List the saved reports (saved queries) defined in Fleet.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-reports](https://fleetdm.com/docs/rest-api/rest-api#list-reports)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope reports to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Reports per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="platform" type="string | null">
  Platform filter (macos, windows, linux, chrome).

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against report name.

  Default: `null`.
</ParamField>

## List software titles

Action ID: `tools.fleetdm.list_software_titles`

List software titles across the fleet with host counts and detected vulnerabilities.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-software](https://fleetdm.com/docs/rest-api/rest-api#list-software)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="exploit" type="boolean | null">
  Only include software with a CISA known-exploited vulnerability.

  Default: `null`.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="max_cvss_score" type="number | null">
  Only include software with a vulnerability at or below this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="min_cvss_score" type="number | null">
  Only include software with a vulnerability at or above this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Software titles per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="platform" type="string | null">
  Platform filter (darwin, windows, linux, chrome).

  Default: `null`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against software title and CVE.

  Default: `null`.
</ParamField>

<ParamField path="vulnerable" type="boolean | null">
  Only include software with known vulnerabilities.

  Default: `null`.
</ParamField>

## List software versions

Action ID: `tools.fleetdm.list_software_versions`

List software versions across the fleet with their associated CVEs.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-software-versions](https://fleetdm.com/docs/rest-api/rest-api#list-software-versions)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="exploit" type="boolean | null">
  Only include versions with a CISA known-exploited vulnerability.

  Default: `null`.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="max_cvss_score" type="number | null">
  Only include versions with a vulnerability at or below this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="min_cvss_score" type="number | null">
  Only include versions with a vulnerability at or above this CVSS score.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Software versions per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against software name and CVE.

  Default: `null`.
</ParamField>

<ParamField path="vulnerable" type="boolean | null">
  Only include versions with known vulnerabilities.

  Default: `null`.
</ParamField>

## List vulnerabilities

Action ID: `tools.fleetdm.list_vulnerabilities`

List CVEs affecting software and operating systems across the fleet.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#list-vulnerabilities](https://fleetdm.com/docs/rest-api/rest-api#list-vulnerabilities)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="exploit" type="boolean | null">
  Only include CVEs with a CISA known-exploited vulnerability (Fleet Premium).

  Default: `null`.
</ParamField>

<ParamField path="fleet_id" type="integer | null">
  Scope results to a fleet (team) ID.

  Default: `null`.
</ParamField>

<ParamField path="order_direction" type="string | null">
  Sort direction (asc or desc).

  Default: `null`.
</ParamField>

<ParamField path="order_key" type="string | null">
  Field to order by (cve, cvss\_score, epss\_probability, cve\_published, host\_count).

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer">
  Page number to retrieve (0-indexed).

  Default: `0`.
</ParamField>

<ParamField path="per_page" type="integer">
  Vulnerabilities per page (Fleet caps at 200).

  Default: `50`.
</ParamField>

<ParamField path="query" type="string | null">
  Search string matched against CVE identifiers.

  Default: `null`.
</ParamField>

## Live query host

Action ID: `tools.fleetdm.live_query_host`

Run an ad-hoc osquery SQL statement live against a single host.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#run-live-report-on-host-ad-hoc](https://fleetdm.com/docs/rest-api/rest-api#run-live-report-on-host-ad-hoc)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID to run the query against.
</ParamField>

<ParamField path="query" type="string" required>
  The ad-hoc osquery SQL statement to run.
</ParamField>

## Lock host

Action ID: `tools.fleetdm.lock_host`

Lock a host via MDM so it cannot be used until unlocked.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#lock-host](https://fleetdm.com/docs/rest-api/rest-api#lock-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

<ParamField path="view_pin" type="boolean | null">
  For macOS, return the six-digit unlock PIN in the response.

  Default: `null`.
</ParamField>

## Refetch host

Action ID: `tools.fleetdm.refetch_host`

Flag a host to refresh its details and policy results on next check-in.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#refetch-host](https://fleetdm.com/docs/rest-api/rest-api#refetch-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Run live report

Action ID: `tools.fleetdm.run_live_report`

Run a saved report live against target hosts and return results synchronously.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#run-live-report](https://fleetdm.com/docs/rest-api/rest-api#run-live-report)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_ids" type="array[integer]" required>
  Numeric IDs of the hosts to run the report against.
</ParamField>

<ParamField path="report_id" type="integer" required>
  Numeric Fleet report ID to run.
</ParamField>

## Run MDM command

Action ID: `tools.fleetdm.run_mdm_command`

Enqueue a raw Apple or Windows MDM command to run on hosts at next check-in.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#run-mdm-command](https://fleetdm.com/docs/rest-api/rest-api#run-mdm-command)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="command" type="string" required>
  Base64-encoded MDM command payload (Apple plist XML or Windows SyncML).
</ParamField>

<ParamField path="host_uuids" type="array[string]" required>
  UUIDs of the hosts to send the command to.
</ParamField>

## Turn off MDM

Action ID: `tools.fleetdm.turn_off_mdm`

Turn off MDM for a host, unenrolling it from Fleet MDM management.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#turn-off-hosts-mdm](https://fleetdm.com/docs/rest-api/rest-api#turn-off-hosts-mdm)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Unlock host

Action ID: `tools.fleetdm.unlock_host`

Unlock a previously locked host, or retrieve its macOS unlock PIN.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#unlock-host](https://fleetdm.com/docs/rest-api/rest-api#unlock-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

## Wipe host

Action ID: `tools.fleetdm.wipe_host`

Remotely wipe a host via MDM, erasing its data.

Reference: [https://fleetdm.com/docs/rest-api/rest-api#wipe-host](https://fleetdm.com/docs/rest-api/rest-api#wipe-host)

### Secrets

Required secrets:

* `fleetdm`: required values `FLEETDM_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>
  Fleet server base URL (e.g. [https://fleet.example.com](https://fleet.example.com)).
</ParamField>

<ParamField path="host_id" type="integer" required>
  Numeric Fleet host ID.
</ParamField>

<ParamField path="wipe_type" type="string | null">
  For Windows, the wipe type (doWipe or doWipeProtected).

  Default: `null`.
</ParamField>