auditbeat cant do Docker FIM, so osquery is kind of my last ditch effort.
06/02/2021, 5:55 PM
Im not really familiar with auditbeat. What are you trying to do?
06/02/2021, 6:34 PM
Monitor FIM within a Docker container not managed by Kubernetes
So I managed to get file_events to work it seems, but the table is not populating
I0602 143324.233469 8265 scheduler.cpp:176] Found results for query: file_events
[root@CentOS7_Filebeat_Auditbeat packs]# osqueryi
Using a virtual database. Need help, type '.help'
osquery> select * FROM file_events;
I've turned selinux to Permissive to rule it out, but can't seem to populate the DB.
Whenever I echo into a given dir that is monitored, the "Found results for query" works... I wonder if its purging as it goes.
06/02/2021, 9:00 PM
osqueryi creates an ephemeral database, and works with it. It does not talk to the a running osqueryd (well, unless you’re invoking it with
But stepping back, I don’t know if you want to run osquery inside the docker container, or on the docker server.
And you probably want to start a new set of questions . I suspect most people aren’t reading this thread.