like if I wanted to do something like this ``` queries file osquery #general

like if I wanted to do something like this ``` "...

pickmansec

08/03/2017, 6:27 PM

like if I wanted to do something like this

Copy code

"queries": {
    "file_events": {
      "query": "select * from file_events;",
      "removed": false,
      "interval": 10
    }
  },

  "file_paths": {
    "etc": [
      "/etc/<folder>/%%"
    ],
  "NOT_file_paths": {
    "etc": [
      "/etc/<folder>/<exclude_this>/%%"
    ],

```

2 Views

Open in Slack

Previous Next