Operator-facing documentation for Fleet EDR. For developer setup see the repo-root README.md.
| You are | Start here |
|---|---|
| Standing up the server for the first time (recommended path) | quickstart-vm.md |
| Standing up the server with your own TLS-terminating ingress | install-server.md |
| Evaluating the agent on a handful of Macs without MDM | install-agent-manual.md |
| Deploying to a fleet via any MDM (Jamf, Kandji, Intune, mosyle, Fleet) | mdm-deployment.md |
| Deploying specifically via Fleet MDM | fleet-deployment.md |
| Upgrading, rotating secrets, recovering from a wiped server, reading logs | operations.md |
| Integrating with the server's HTTP API | api.md |
| Delivering alerts to an external endpoint over a signed webhook | webhooks.md |
| Understanding how the pieces fit together | architecture.md |
| Setting up Okta or another OIDC IdP for operator login | okta-setup.md |
| Recovering when SSO is unavailable, registering a second security key | breakglass.md |
| Reviewing what threats the product covers and where the gaps are | threat-model.md |
The recommended path: stand up the server on a single Linux VM with your own domain (one script, automatic Let's Encrypt certificate, no edge WAF to block agent telemetry), then push the agent to your Macs through Fleet MDM. See quickstart-vm.md for the server and fleet-deployment.md for the agents.
- Server: container image
ghcr.io/getvictor/fleet-edr-serverrunning behind your TLS-terminating ingress, backed by MySQL 8.4. Serves the agent ingestion API, the admin web UI, and the OTel metric pipeline. - Agent: signed + notarized
.pkginstalled on each macOS endpoint. Runs as a LaunchDaemon, receives events from an embedded system extension over XPC, queues them in SQLite, uploads to the server. - MDM profiles: two unsigned
.mobileconfigfiles that pre-approve the system extension and grant Full Disk Access. Delivered by whichever MDM the customer uses; the MDM signs them at delivery time. - Install script: a one-line Bash snippet your MDM runs before the
.pkginstaller to drop the enroll secret into/etc/fleet-edr.conf.
Artifacts ship on each GitHub Release:
fleet-edr-<version>.pkg(signed + notarized)edr-system-extension.mobileconfig(unsigned; your MDM signs at delivery)edr-tcc-fda.mobileconfig(unsigned; your MDM signs at delivery)SHA256SUMS(verify your downloads)
Server image is tagged on each release: ghcr.io/getvictor/fleet-edr-server:<version>. :latest only advances on stable (non--rc, non--beta) tags.
- Issues: https://github.com/getvictor/fleet-edr/issues
- Security reports: follow the SECURITY.md process at the repo root.