https://github.com/osquery/osquery logo
Powered by
#general
Title
# general
g

gsat

09/25/2018, 2:49 PM
@Mustafa As per the document " the associated 'dirty' query is blacklisted from running for 24 hours. " How can I reset this for my testing purpose to run that query in next session?
m

Mustafa

09/25/2018, 2:54 PM
hmm. i wonder if using --disable_watchdog=true a solution for this or i don’t know what the answer is
d

Dennis

09/25/2018, 3:29 PM
You can set 
"blacklist": false
in the query object in your pack.
E.G. -
Copy code
"windows_programs": {
      "query": "SELECT name, version, language, install_source, publisher, identifying_number, install_date FROM programs;",
      "interval": 14400,
      "removed": false,
      "blacklist": false,
      "description": "Get all the installed programs on the target machine.",
      "platform": "windows"
    }
g

gsat

09/25/2018, 4:32 PM
yes "blacklist": false attribute seems to be working
👍 1
m

Mustafa

09/26/2018, 7:23 AM
is there a place where all of these key value explained? or in other word what is the whole list of these key value matching?
2 Views
Powered by