Thomas Stromberg
10/17/2022, 3:02 PMterracatta
fritz
10/17/2022, 3:33 PMinteractive
mode which you can use to accomplish this even more easily. I need to update my blog post! 😄seph
/usr/local/kolide-k2/bin/launcher interactive
should work. It won’t get you the ATC configs, but that’s an unusual thing to needJames Pickett
10/17/2022, 5:59 PM/usr/local/kolide-k2/bin/launcher interactive
like --osquery_flag=config_path=<path_to_your_config>
, there are details on finding the ATC configs in the article Jason postedThomas Stromberg
10/20/2022, 3:23 PMlauncher interactive
quite a bit for my testing.
One thing I noticed in this mode is that it doesn't respect the eventing settings from Kolide:
osquery> SELECT * FROM socket_events;
W1020 11:18:25.713606 1471864192 virtual_table.cpp:969] Table socket_events is event-based but events are disabled
W1020 11:18:25.713634 1471864192 virtual_table.cpp:976] Please see the table documentation: <https://osquery.io/schema/#socket_eve>
I see you can pass --osquery_flag
though which helps.seph
--osquery_flag
parametersThomas Stromberg
10/20/2022, 3:26 PMseph