Ted Dorosheff
01/22/2022, 2:40 PMosqueryi.exe --flagfile=osquery.flags
from C:\Program Files\osquery. remote config (fleetDM) is successfully loaded, as corroborated by running --tls_dump
in another separate process at another time (no conflicting PIDs).
2. within osqueryi.exe run select * from osquery_events;
. ntfs_journal_events and powershell_events is active.
3. From powershell (though i have also tested via UI and CMD shell) write text files to directories monitored via file_paths
. ex: - 'C:\Windows\Temp\'
is listed in `file_paths`and i write text files to this directory, as well as modify existing files within this directory.
4. back in my osqueryi.exe shell, run select * from osquery_events;
again and see that those test events have still not changed the events counter for ntfs_journal_events
or powershell_events
. Both of those tables still read 0 events.zwass
01/22/2022, 5:08 PMTed Dorosheff
01/22/2022, 5:50 PM