So quick question, with osqueryd how do I specify ...
# general
p
So quick question, with osqueryd how do I specify a specific file and only that file, and still get it's hash?
Copy code
"passwd": [
        "/etc/passwd"
    ],
Gets me an attributes modified note and then every subsequent edit doesn't change anything in file_events. However when I do
Copy code
/etc/%passwd
I get all the data I need but I also get all the .swp and swpx files.