Are query packs a recommended way of scheduling queries? I'm confused about the difference between 'Schedule' configuration option and 'Pack' configuration options.
z
zwass
08/19/2020, 7:01 PM
Yeah, typically. Query packs help provide a bit more organization and context, and can also be loaded from separate files.
g
grant seltzer
08/19/2020, 7:02 PM
Interesting, I assume packs came later on
I mentioned in #kolide and #extensions as well as below, but would you expect pack query results to be logged in the same way as scheduled queries?
z
zwass
08/19/2020, 7:03 PM
Yes -- just with the pack name prepended to the query name