Hi. I'm try to run a pack using osqueryi (for tes...
# general
o
Hi. I'm try to run a pack using osqueryi (for testing, I know osqueryd is the one you typically use to run packs). This is supported in osqueryi using either the --pack flag or the --config_path as mentioned here: https://github.com/facebook/osquery/issues/3433 However, when I tried running both the ossec-rootkit.conf pack (https://raw.githubusercontent.com/facebook/osquery/master/packs/ossec-rootkit.conf) on Linux or the os-attacks.conf pack (https://github.com/facebook/osquery/blob/master/packs/osx-attacks.conf) on Mac OS X, it appears to not even run Any ideas on the correct syntax? I tried the following: osqueryi --config_path ossec-rootkit.conf -A osquery_packs but I see no results I then created by own pack that just has a single query that shows the os_version but again I see no results Any ideas?