<https github com facebook osquery issues 5381> osquery #general

<https://github.com/facebook/osquery/issues/5381>

钢铁侠

01/22/2019, 8:35 AM

钢铁侠

01/22/2019, 2:55 PM

I find that maybe the

watch_dog

settings aren't applied.

clong

01/22/2019, 9:09 PM

posted a response

钢铁侠

01/23/2019, 1:43 AM

osquery add his audit rule to the audit according to

audit_allow_config

. if the

audit_allow_config

false

,It means that the osquery will use the rules that exists before in the system but not add the rule it's own.

钢铁侠

01/23/2019, 4:31 AM

@clong

5 Views