Macear
09/30/2020, 7:55 AMseph
09/30/2020, 10:47 AMMacear
09/30/2020, 11:16 AMseph
09/30/2020, 12:32 PMMacear
09/30/2020, 12:59 PMseph
09/30/2020, 1:08 PMMacear
09/30/2020, 1:23 PMseph
09/30/2020, 1:40 PMMacear
09/30/2020, 1:42 PMseph
09/30/2020, 1:42 PMtheopolis
09/30/2020, 2:36 PMMacear
09/30/2020, 4:55 PMseph
10/01/2020, 2:03 PMtheopolis
10/01/2020, 3:31 PMBut is there any setting to make osquery run a query on startup? I e osquery starts and run queries once?I do not think this really exists but several folks have asked for it. I think we could support it with a new feature
{
"query": "select * from TABLE_NAME",
"startup": true
}
seph
10/01/2020, 3:44 PMstartup: true
would bias that to execute in the very beginning. Still have to work through not melting the machine.Macear
10/02/2020, 9:15 AMseph
10/02/2020, 10:54 AMMacear
10/02/2020, 12:13 PMseph
10/02/2020, 2:07 PMMacear
10/02/2020, 3:09 PMseph
10/02/2020, 8:27 PMterracatta
10/02/2020, 8:48 PMMacear
10/03/2020, 9:12 AM