Ted Dorosheff
01/24/2022, 9:04 PM{
"schedule": {
"file_events": {
"query": "SELECT * FROM ntfs_journal_events;"
"removed": false,
"interval": 300
}
},
"file_paths": {
"windows": [
'C:\Windows\Temp\'
'C:\Windows\Tasks\'
],
"Users": [
'C:\Users\%\'
],
"osquery": [
'C:\Program Files\osquery\'
]
},
"exclude_paths": {
"windows": [
'C:\Windows\Temp\test\'
],
"Users": [
'C:\Users\teddoro\test\'
]
}
}
terracatta
01/24/2022, 9:21 PM"query": "SELECT * FROM ntfs_journal_events;"
{
"schedule": {
"file_events": {
"query": "SELECT * FROM ntfs_journal_events;",
"removed": false,
"interval": 300
}
},
"file_paths": {
"windows": [
"C:\\Windows\\Temp\\",
"C:\\Windows\\Tasks\\"
],
"Users": [
"C:\\Users\\%\\"
],
"osquery": [
"C:\\Program Files\\osquery\\"
]
},
"exclude_paths": {
"windows": [
"C:\\Windows\\Temp\\test\\"
],
"Users": [
"C:Users\\teddoro\\test\\"
]
}
}
Ted Dorosheff
01/24/2022, 9:33 PMterracatta
01/24/2022, 9:46 PMTed Dorosheff
01/24/2022, 9:46 PMterracatta
01/24/2022, 9:49 PMTed Dorosheff
01/24/2022, 9:49 PM