Title
#general
z

Zach Zeid

02/18/2020, 8:23 PM
does anyone use https://osquery.io/schema/4.1.2#file_events to replace their FIM?
zwass

zwass

02/18/2020, 8:31 PM
Yes, many folks use that for FIM.
z

Zach Zeid

02/18/2020, 8:33 PM
Can I assume I would be able to see the diff of changes? or does it just show the sha of the change after the fact?
zwass

zwass

02/18/2020, 8:34 PM
Guillaume

Guillaume

02/19/2020, 12:56 AM
Yeah no file content. But I love using it instead of deploying something else to check that FIM box heh