allister
09/23/2023, 2:07 PMMehmet
09/27/2023, 10:51 AMsignature
table works on macOS in terms of the validation of a signature. I have a binary which has a valid ad-hoc signature(no team identifier and authority is available). I would expect the is_signed
value to be 0
, but I'm getting 1
. Is it an expected behavior for being signed when there is a valid signature without team identifier and authority?Jakob Magun
10/03/2023, 10:56 AMGary
10/03/2023, 7:15 PMselect * from disk_encryption;
query, it doesn't seem to give me the correct result for encryption_status
and filevault_status
. How can I fix this issue? Thanks.Guilherme Monteiro
10/05/2023, 11:51 AMAkash Patel
10/06/2023, 4:31 PMPriya Jagyasi
10/09/2023, 10:15 AMallister
10/09/2023, 11:17 AMMehmet
10/11/2023, 8:13 AMallister
10/11/2023, 9:01 AMJakob Magun
10/15/2023, 10:53 AMwdavdaemon
process is running but this will not assure that realtime protection is actually enabled. The command mdatp health
provides status information. Any ideas for a solution?Glen
10/25/2023, 2:47 PMbioutil
command, but that isn’t great for change detection. Maybe there’s a way to query changes via asl
logging? Asking here because possibly someone has already figured this out?Kiwito
11/01/2023, 5:35 PMtlark
11/09/2023, 4:34 PMScott Bonar
11/20/2023, 6:38 PMRafa Bono
11/30/2023, 9:43 AMcrontab
table is returning nothing. But having results by running crontab -l
. Am I missing anything?lvferdi
12/06/2023, 3:22 PMallister
12/06/2023, 3:27 PMsean.cavanaugh
01/09/2024, 4:55 PM/Users/*/.zsh_history
) being tracked by the es_process_file_events
table?Mike
01/24/2024, 6:36 AMallister
01/24/2024, 7:23 AMvedang agarwal
02/19/2024, 11:05 AMZane Alumbaugh
03/08/2024, 7:16 PMextension_timeout
), however when we run osqueryd
manually from the command line it takes the extension_timeout
period or less for the first logs to come in. Is this expected behavior, or any idea why this might be happening? Note that none of the status logs get dropped when running using launchctl.allister
03/09/2024, 4:20 PMnice
or priority settings that the ‘user’/interactive CLI doesn’t have to contend with when running manually, at least that would be my naive/presumptuous reasoningallister
03/09/2024, 4:21 PMallister
03/09/2024, 4:22 PMallister
03/09/2024, 4:24 PMallister
03/09/2024, 4:28 PMEvan Romasco-Kelly
03/14/2024, 10:23 PMosqueryi
, bash can’t find the command. Then, when I look at /opt/osquery/lib/
it’s empty, no osquery.app
. I have previously installed via Homebrew and had the same issue (after a number of initial successful installs/deinstalls when testing an osquery install script). Tried all sorts of cleanup steps to try and get a greenfield install, but nothing seems to be working.
Any idea what’s going on here?kyle
03/15/2024, 6:14 AM