How do you improve the accuracy of alarm with osquery for host intrusion detection The biggest problem I have encountered now is that I can't do the difference query. I only want to query the results of columns to change before generating the log, so as to alarm As shown in the figure below, this is the problem I encountered. I set the one-hour interval to query the timing tasks running on the host, but columns did not change and the logs were generated (only the time was changed in the comparison between the two logs).

The epoch for the results is 0 for both of those logs. That may indicate an error but if definitely means the first result was not compared to the second.

Do you mean that osquery may not save the last query result record to the virtual table so that the next query will not be able to compare results? And what does this epoch represent?And what does the action in the log represent?

Yes, epoch counts the number of times the specific scheduled query has been run. If you have a query in the schedule

SELECT * FROM system_info

then change that query to

SELECT * from system_info

the results will be invalidated and the epoch will restart at 0. The action indicates if the row was observed as added (newly observed) or removed (no longer existing). This page goes into some detail about these metadata fields: https://osquery.readthedocs.io/en/latest/deployment/logging/#schedule-results

Well, I looked in my journal and found that the epoch was zero and I thought I needed to look at this place

Hey, I don't have a lot of time to help debug right now (sorry about that). The epoch staying 0 seems expected and supports the fact that you have not changed the query. Are you sure the query is not a

snapshot:true

query? I am not sure what this looks like in the Fleet UI but a snapshot-type query skips the differential comparison.

I'm sorry to interrupt your time.So this is my settings on Fleet Thank you for your time

Can you turn that to not ignore removals?

YES I changed to not Ignore removals the other day The following observation log changes from columns. xxx to diffResults A lot of diffResults appeared