I can't query windows event logs, osquertyi just s...
# general
m
I can't query windows event logs, osquertyi just says: "W1025 052338.988976 11352 virtual_table.cpp:968] Table windows_events is event-based but events are disabled W1025 052338.988976 11352 virtual_table.cpp:975] Please see the table documentation: https://osquery.io/schema/#windows_events" which is completely unhelpful as I follow the link and it's just a schema for the table... it doesn't tell me how to enable events, nor can I find anywhere how to do so. I tried the flag --windows_event_channels=System,Application,Setup,Security to "subscribe" to those event channels but it didn't do anything, most likely because as the error message says... events are not enabled. Cannot find how to enable them.