Hello! Is there any way to run locally fleet queries while disconnected from the internet? The fleet deployment has some tables I'd like to query but I cannot query them by using
osqueryi
as I'd need to create the custom ATC first. Same for custom Fleet tables. Any thoughts?
k
Kathy Satterlee
03/01/2024, 2:03 AM
Hi @Rafa Bono! This is technically possible, but requires connecting to the socket used by osqueryd, which has the potential to cause errors or corruption. Because of that, I generally wouldn’t recommend doing it.