Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I noticed a similar error when I had an extra ‘/’ in the request URL. Can you view the request url and body as they are being sent from your platform?

Has anyone tried doing live query over rest API?  I would be curious to see any tested version request - response.

Response:

```{
    "summary": {
        "targeted_host_count": 1,
        "responded_host_count": 1
    },
    "live_query_results": [
        {
            "query_id": 778,
            "results": [
                {
                    "host_id": 78,
                    "rows": [
                        {
                            "action": "add",
                            "datetime": "2023-05-19 03:45:36",
                            "path": "",
                            "vendor": "Apple"
                        },
                        {
                            "action": "add",
                            "datetime": "2023-05-19 03:45:36",
                            "path": "",
                            "vendor": "Apple"
                        },
                        {
                            "action": "add",
                            "datetime": "2023-05-19 03:45:36",
                            "path": "",
                            "vendor": "Apple"
                        },
                        {
                            "action": "remove",
                            "datetime": "2023-05-19 03:45:46",
                            "path": "",
                            "vendor": "Apple"
                        },
                        {
                            "action": "remove",
                            "datetime": "2023-05-19 03:45:46",
                            "path": "",
                            "vendor": "Apple"
                        },
                        {
                            "action": "remove",
                            "datetime": "2023-05-19 03:45:46",
                            "path": "",
                            "vendor": "Apple"
                        }
                    ],
                    "error": null
                }
            ]
        }
    ]
}```

Perfect. Just wanted to make sure. It sounds like something is going awry with the request body. Is anything showing up in the Fleet logs?

Yes, I tried postman, and even in CLI using curl  and it works on postman and terminal but something is going on the request body that it is not accepting and still failing from SOAR. I am still troubleshooting.

How would you feel about hopping on Zoom to see if anything stands out to me?

So I resolved the issue. It needed entire request to go in GET request including body parameters. Thanks <@U02KY9FDA59> for all your help.

I was wondering if Tines was being weird about the request body because it was a GET

Yes it was and what was needed to be done is this -