Jens Willmer
09/26/2022, 11:04 AMsharvil
09/26/2022, 11:13 AMJens Willmer
09/26/2022, 11:17 AMsharvil
09/26/2022, 11:36 AMNow I would like to use my workflow automation system to query predefined queries (via HTTP?) every now and then. Is this possible?I am not completely sure to be honest, I think something (which could be your workflow automation system) would have to implement the osquery remote APIs (https://osquery.readthedocs.io/en/latest/deployment/remote/#remote-server-api) and then would have to ad-hoc do a query to
osquery_schedule
table, I don't know if there is a simpler way thoughJens Willmer
09/26/2022, 12:26 PMsharvil
09/26/2022, 12:40 PMselect * from osquery_schedule
query to the schedule, and have the osquery results.log
shipped outJens Willmer
09/26/2022, 12:47 PMsharvil
09/26/2022, 1:13 PMbatch
format along with differential
when configuring the logging -- https://osquery.readthedocs.io/en/latest/deployment/logging/#event-formatJens Willmer
09/26/2022, 3:17 PMseph