Hi Guys, I had a question. If a table is empty and not populated, does using SELECT * from TABLE; give an empty table or no output at all?
m
Mike Myers
11/17/2020, 9:18 PM
all tables' contents are generated in response to the query, so the table doesn't exist anywhere in memory or anything, it doesn't exist until you query
🙌 1
unless it's an evented table, in which case the events are being spooled all the time, and then querying the evented table does empty some or all of the spool depending on your settings
u
Usama Nathani
11/17/2020, 9:51 PM
Okay thank you! I am currently trying to enable yara_events for windows, and since the table is not being populated (still testing), it will give an empty output correct?
m
Mike Myers
11/18/2020, 6:39 AM
yes, you might want/need to create a test file that is expected to trigger a yara rule, to make sure it's working