Macear
09/30/2020, 7:55 AMseph
Macear
09/30/2020, 11:16 AMMacear
09/30/2020, 12:12 PMseph
seph
seph
Macear
09/30/2020, 12:59 PMMacear
09/30/2020, 1:04 PMseph
seph
seph
Macear
09/30/2020, 1:23 PMMacear
09/30/2020, 1:33 PMseph
Macear
09/30/2020, 1:42 PMseph
theopolis
Macear
09/30/2020, 4:55 PMMacear
10/01/2020, 2:52 AMMacear
10/01/2020, 2:55 AMseph
theopolis
But is there any setting to make osquery run a query on startup? I e osquery starts and run queries once?I do not think this really exists but several folks have asked for it. I think we could support it with a new feature
{
"query": "select * from TABLE_NAME",
"startup": true
}
seph
seph
seph
startup: true
would bias that to execute in the very beginning. Still have to work through not melting the machine.seph
Macear
10/02/2020, 9:15 AMseph
Macear
10/02/2020, 12:13 PMseph
seph
Macear
10/02/2020, 3:09 PMMacear
10/02/2020, 3:14 PMseph
seph
seph
seph
seph
terracatta
Macear
10/03/2020, 9:12 AM