Osquery - General Threads

Channels

Topic	Authors	Views	Replies	Activity
What would the ramifications of using the `--disable_database` flag be? Would blacklisted queries no longer be recorded/enforced?	s	3	2	1 year ago
general question: There isn't really a way for osquery to _read_ a file, correct?	z	0	3	1 year ago
How do we force osquery to expire old data in case of no connection between the osquery endpoint and the host server. For example if there is no connection between the server and the endpoint for say 12 hours, how do we ...	v	1	3	1 year ago
Hi guys, Maybe I missing something but "carbon_black_info" not work at all (return empty table), Anyone know about it?	e	1	3	1 year ago
Does anyone know of a way to get osquery to connect to a local tls endpoint without having to compile the binary with the `--tls_allow_unsafe` option turned on?	c	0	4	1 year ago
@fritz good idea, let me check	e	0	3	1 year ago
anyone running FIM on production linux hosts - how's the performance?	b	0	2	1 year ago
Hi everyone. Have anybody seen or create a query able to perform geolocation? either by querying an external source or pointing a range of IPs? Thank you	s	0	2	1 year ago
Interestingly, I have this as a schedule `"schedule": { "ping_pong": { "query": "select year, month, day from time;", "interval": 10 } },` but I don't see it show up in either my tls ...	z	0	3	1 year ago
I'm working on splitting results to multiple interfaces, but I'm running into an issue. it says I can enable multiple loggers by setting `--logger_plugin` to a comma separate list. My config file is JSON, but when I do ...	z	1	3	1 year ago

What would the ramifications of using the
--disable_database
flag be? Would blacklisted queries no longer be recorded/enforced?
2 Replies
1 year ago
z
general question: There isn't really a way for osquery to _read_ a file, correct?
3 Replies
1 year ago
v
How do we force osquery to expire old data in case of no connection between the osquery endpoint and the host server. For example if there is no connection between the server and the endpoint for say 12 hours, how do we ...
3 Replies
1 year ago
e
Hi guys, Maybe I missing something but "*carbon_black_info"* not work at all (return empty table), Anyone know about it?
3 Replies
1 year ago
c
Does anyone know of a way to get osquery to connect to a local tls endpoint without having to compile the binary with the
--tls_allow_unsafe
option turned on?
4 Replies
1 year ago
e
@fritz good idea, let me check
3 Replies
1 year ago
b
anyone running FIM on production linux hosts - how's the performance?
2 Replies
1 year ago
Hi everyone. Have anybody seen or create a query able to perform geolocation? either by querying an external source or pointing a range of IPs? Thank you
2 Replies
1 year ago

Interestingly, I have this as a schedule

"schedule": {
     "ping_pong": {
        "query": "select year, month, day from time;",
        "interval": 10
       }
  },

but I don't see it show up in either my tls ...

3 Replies

1 year ago

z
I'm working on splitting results to multiple interfaces, but I'm running into an issue. it says I can enable multiple loggers by setting
--logger_plugin
to a comma separate list. My config file is JSON, but when I do ...
3 Replies
1 year ago