THe doc for FIM provides some nice thoughts on troubleshooting no entries for linux and macos but not much for windows. trying to set up FIM based on the docs and am not getting any entries into the ntfs_journal_events table: 🧵

Is there a way to make osquery isolate a machines network connectivity to only a few web servers?

Hi Osquery team, may i know all the libs under osquery/libraries/ are only used for building osquery, is that correct?

The only two windows hosts I have enrolled are not responding to custom queries (even the basic SELECT * FROM osquery_info) - Seems to be stuck at : Fleet is talking to your hosts, (0% responded). However, I am able to fetch fresh vitals within a couple of seconds for both hosts. Any ideas on what could be wrong here?

Has anyone here used osquery atc to gather browser extensions data?

Hi Team I have integrated osquery with Wazuh using the documentation https://documentation.wazuh.com/current/user-manual/capabilities/osquery.html but getting error as

E1226 13:26:04.488592 98366 shutdown.cpp:79] Worker returned exit status

Hi osquery team, based on the version like 5.4.0 and https://github.com/osquery/osquery/issues?q=is%3Aissue+label%3Acve, can we say all the cve are eliminated?

Hi Team, is there anyway to get per process in focus time/screen time using osquery?

Hi Team, is there anyway to get network usage per process using osquery?

hi is it ok that I will have at my flag file path to extension that not exists? I'm using osquery 4.8

5.7.0 is stable! https://github.com/osquery/osquery/releases/tag/5.7.0

Hi osquery team, does osquery allow concurrent running of queries on host? or never or it could be controlled?

Hi, team! I use fleet, mariadb, redis and osquery in macOS. And recently i have one problem. I make query in UI fleet on host, but i don't get result. I think that agent on host doesn't get query. I checked, when i make query in UI Fleet, query appears in mariadb, and i view new key in redis. May be you know that i need check and how make it. Thanks!

Hello there! Is there any way I can fully disable software inventory and software vulnerability? I’m pretty confident that the execution of this query while installing orbit on our hosts are causing too many LDAP search requests to our server sand it’s not being able to handle it, so I’d like to completely disable this feature.

Hi, How do i completely uninstall fleet desktop v1.3.1 in Mac? Thanks!

Hey all, has anyone deployed osquery to macOS devices with Intune?

Hi osquery team, could u help to explain what does it mean for Accelerate returned by some osquery api? it looks like meaning the agent could when the last try is failed, is that correct?

In the scenario osquery is disconnected and configured with scheduled queries the results are buffered. What if I disable the scheduled queries before sending? Are those results deleted? Will be sent if I re-enable that query later?

Hi team, Can i write an extension for osquery in golang and make in run using the flag file? I wrote an extension that uses a command line parameter of the osquery socket, and i want to make it run without it

Hello team - I have a newbie question, hopefully that's ok to post! I am attempting to monitor the shell_history of a Linux system (Ubuntu). Specifically I am looking for sudo activity. When I run SELECT * from shell_history using my account, I can see some of the sudo commands I have performed, which is good. But any new sudo commands (or non-sudo commands) are not showing up in this table (example: sudo vi /etc/sudoers). I suspect I'm missing something simple, just not sure what it is.

Hello everyone, is there any table in osquery returning a unique and persistent ID for the device osquery is running on? The UUID in system_info is unique but after a reboot it changes in my VM.

What products would you recommend for centralized management of endpoints outside of Fleet/Kolide? Needs to be free/open-source. I know there is a free option for Fleet, but I'd like to see if there are other platforms that have better functionality.

Does anyone know if user interaction events for keyboard and mouse are dead? Looking at this issue seems to imply that they are (or need additional permissions?): does anyon

Hi Osquery team, I read the doc of osquery api like distributed_read. and i c the normal response goes like { "queries": { "id1": "SELECT * FROM osquery_info;", "id2": "SELECT * FROM osquery_schedule;", "id3": "SELECT * FROM does_not_exist;" }, "node_invalid": false // Optional, return true to indicate re-enrollment. } i would like to know what about the err case? what is the format and how does osquery handle it?

[osquery:master] 1 new commit by Artemis Tosini:

<https://github.com/osquery/osquery/commit/e4cef8689bb29078cc2bf06689c2ce5d39636efb|e4cef86>

Add

unit_file_state

column to ``systemd_units`` table (#7895) - Artemis Tosini

hi!

I am getting an error when I try to build the installer for a windows host. The same thing happens to me from a linux host trying to generate the installer for a windows

PS .\fleetctl.exe package --type=msi --fleet-desktop --fleet-url=<https://x.x.x.x:8080> --enroll-secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Generating your osquery installer...
wineserver: socket: Function not implemented
Error: package root files: heat failed: exit status 1

Hi osquery team, could u offer some doc present how to use carve?

[osquery:master] 1 new commit by Stefano Bonicatti:

<https://github.com/osquery/osquery/commit/37b5410e271d9431f7f5c454b4f092a5515f4756|37b5410>

libs: Update dbus to 1.12.24 (#7905) - Stefano Bonicatti

[osquery:master] 1 new commit by Nathan Breakwell:

<https://github.com/osquery/osquery/commit/613028a6384d4e0b101fe087717c2dfdcde3efbf|613028a>

Fix leaks in scheduled_tasks (#7903) (#7904) - Nathan Breakwell