Daniel Cross03/16/2023, 5:17 AM
type of capability with OSQuery? I think not but maybe I’m missing a way to do this. Could be a good first contribution task for me 🤔 http://ftp.rpm.org/max-rpm/ch-rpm-verify.html
table. I suspect one could construct SQL to use the sha from
, the file table, and the
table to create that functionality. I have no idea how performant it would be. As a side note, osquery does not shell out to collect information.
Daniel Cross03/20/2023, 4:34 AM