Why would a snapshot query be doubling up and telling me tha

Question

Why would a snapshot query be doubling up and telling me that the things are both on and off at the same time

seph · Answer

osquery generally wouldn t You mentioned your query is `SELECT type state FROM windows security products` That should produce two rows each with two columns

seph · Answer

Your screenshot looks like a SIEM post processing a log pipeline I d look to either your SIEM parsing rules or your log pipeline

seph · Answer

Try to get logs from earlier to diagnose where your failiure is

Mystery Incorporated · Answer

Hi < seph> here is the JSON that is returned directly from osquery pre processing into elastic ` snapshot state On type Firewall state Off type Firewall state On type Antivirus state Off type Antivirus action snapshot name pack Windows Base Pack fw av snapshot hostIdentifier xxx calendarTime Fri Jul 30 06 19 03 2021 UTC unixTime 1627625943 epoch 0 counter 0 numerics false decorations company xxx host hostname xxx username xxx `

Mystery Incorporated · Answer

< seph> it seems like osquery is reporting two conflicting states for the same query how can that be

seph · Answer

Pretty weird What s the scheduled query

Mystery Incorporated · Answer

It s just `SELECT type state FROM windows security products` set as a snapshot query and told to run every 112 seconds

Mystery Incorporated · Answer

It would appear that it does not do it all the time however as I can see some good looking results such as ` snapshot state On type Firewall state On type Antivirus action snapshot name pack Windows Base Pack fw av snapshot hostIdentifier xxx calendarTime Sat Jul 31 00 43 39 2021 UTC unixTime 1627692219 epoch 0 counter 0 numerics false decorations company xxx host hostname xxxx `

seph · Answer

Does the osquery schedule show exactly what you think the query is If you `select ` do the other columns hint at anything

Mystery Incorporated · Answer

< seph> where do I see the osquery shedule

Mystery Incorporated · Answer

This mystery has been solved Scooby

Mystery Incorporated · Answer

Turns out user installed Bitdefender and so it is reporting Bitdefender on Microsoft Defender off

seph · Answer

Would that have been visible in a `select `

Mystery Incorporated · Answer

That s what I did just now yea

Mystery Incorporated · Answer

I had to wait for the machine to come back online

seph · Answer

great

Mystery Incorporated · Answer

I need to rethink how I m alerting on that table in that case