Hi Folks I m wondering if ` disable events=false` needs to b osquery #general

Hi Folks. I'm wondering if `--disable_events=false...

Erich Stoekl

03/16/2020, 6:00 PM

Hi Folks. I'm wondering if

--disable_events=false

needs to be used with

--disable_audit=false

zwass

03/16/2020, 6:04 PM

No it does not.

Erich Stoekl

03/16/2020, 6:05 PM

If I don't use

disable_events=false

, how would I pick up on the process_events data?

Erich Stoekl

03/16/2020, 6:08 PM

would I just not have the

process_events

table in that case (if i'm monitoring process events)?

zwass

03/16/2020, 6:11 PM

Ah sorry I interpreted your question backwards. Yes, you need to enable events in order to get any event-based tables.

Erich Stoekl

03/16/2020, 6:17 PM

no worries. Thanks!!

4 Views