Peter
09/08/2021, 12:18 PMread_max
applies to all interactions that osqueryd
may have with a given file - such as hashing, and on-demand yara scans ( triggered via snapshot queries)?seph
09/08/2021, 12:20 PMStefano Bonicatti
09/08/2021, 12:25 PMPeter
09/08/2021, 12:26 PMsharvil
09/08/2021, 12:39 PMread_max
also doesn't apply to the ssdeep
column(s) in the hash tablePeter
09/08/2021, 12:42 PMssdeep
and friends still be computed? As an example:
...
hash.md5 as md5, hash.sha1 as sha1, hash.sha256 as sha256 FROM processes JOIN hash USING
...
sharvil
09/08/2021, 12:45 PMPeter
09/08/2021, 12:46 PMseph
09/08/2021, 12:59 PMread_max
applies in places osquery reads the content of a file. In places where itβs passing a filename to some other library, that library may read the whole thing.
Iβm not sure why anyone would know which hashing functions come out of which places. But it maybe helps understand why a join would be finePeter
09/08/2021, 1:07 PM