https://github.com/osquery/osquery logo
h

HarlanF

10/21/2021, 3:28 PM
If I've got a couple extensions, does anyone have a sense of whether I need to include their table names in the
--enable_tables
parameter in order for scheduled queries to see them?
s

seph

10/21/2021, 3:46 PM
You should not need to.
j

Juan Alvarez

10/21/2021, 3:46 PM
afaik, if enable_tables is empty you dont have to do so.
s

seph

10/21/2021, 3:47 PM
Well… It depends. If it’s empty, all tables will be enabled. If you list some, it acts as an allow lists limited to those tables.
4 Views