I tried the included "incident-response": "/usr/sh...
# general
a
I tried the included "incident-response": "/usr/share/osquery/packs/incident-response.conf"