https://github.com/osquery/osquery logo
j

jby

12/02/2020, 8:59 AM
Newbie question warning!! Where do query packs go? Do every client need to have them locally?
j

Juan Alvarez

12/02/2020, 11:51 AM
If you are using fleet along osquery you can configure them in the fleet server only i would say
c

ccombs

12/02/2020, 3:53 PM
Query packs can either be configured with a config file (so locally on the machines running osqueryd), or they can be sent by using your fleet server. Like Juan said, the latter is better if you're using fleet to organize your osquery machines.
j

jby

12/02/2020, 4:32 PM
Yeah, but how do I get them into the fleet-instance?