Channels
- bConfigured osquery for all the events. Still I am getting below error. "Table syslog_events is event-based but events are disabled". However osquery log is getting syslog.
2 Replies
3 years ago - gAh reading the issue better I see that it’s in the user context
3 Replies
3 years ago - sHi - I am tracking an issue on the chrome browser extensions table failing to return results https://github.com/facebook/osquery/issues/5563 is there another issue related i can track Ive noticed this one isnt yet assi...
3 Replies
3 years ago - message has been deleted
3 Replies
3 years ago - jIs there any way of logging in the results.log the name of the table that the logs are from? rather than the arbitrary 'pack_xyz' identifier at the start of each result
4 Replies
3 years ago - athis branch is based on experimental 🤔
3 Replies
3 years ago - jWhat is the best way to log simple authentication events from Mac? I tried the table 'last' but it doesn't log success/failures and logs about 80 events per 'login'. I'm trying to look at 'user_events' but I am not sure ...
2 Replies
3 years ago - dhey folks working with yara_events. It seems like FIM works against both directories when I specify them like this: "file_paths": { "home": [ "/root/%%", "/home/%%" ] } ...but when I add the yara part like below,...
4 Replies
3 years ago - a@groob Here is my case - I want to extend osqueryd with my logger that read windows events and execute sql query like select * from windows_events where time >(select time from windows_events where eventid = xxx...
3 Replies
3 years ago 
Great query @Guillaume!https://twitter.com/gepeto42/status/1128383095428743172▾
4 Replies
3 years ago