Jean M
04/15/2020, 6:29 PM"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT hardware_serial FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;",
"SELECT hostname FROM system_info LIMIT 1;"
]
},
seph
04/15/2020, 6:37 PMload
and not something else? https://osquery.readthedocs.io/en/stable/deployment/configuration/#decorator-queriesJean M
04/15/2020, 7:37 PM"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT hardware_serial FROM system_info;"
],
"always": [
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
],
"interval": {
"3600": [
"SELECT hostname FROM system_info LIMIT 1;"
]
}
},
Thanks, I’ll try with this new configurationseph
04/15/2020, 8:15 PMalways
and load
but I have no idea what an interval decorator query is.Jean M
04/15/2020, 8:42 PMThetype uses a map of interval ‘periods’ as keys, and the set of decorator queries for each value. Each of these intervals MUST be minute-intervals. Anything not divisible by 60 will generate a warning, and will not run.interval
seph
04/15/2020, 8:43 PMJean M
04/15/2020, 10:38 PM