https://github.com/osquery/osquery logo
Title
m

Mustafa

04/27/2018, 11:38 AM
is Osquery able to read a file content and send them as logs?
t

theopolis

04/27/2018, 12:38 PM
Nope, we sort of resist doing this. If there’s a single file you believe everyone in the world should read and report on we can morph that content into a virtual table.
z

zwass

04/27/2018, 4:07 PM
Doesn't the file carver do this?
m

Mustafa

04/28/2018, 12:48 PM
i would be glad if you give some information about file carver. is it related to carves table?
o

obelisk

04/30/2018, 4:01 PM
The file carver can do this but it is slightly more complicated to set up. @theopolis is right that we resist doing this so easily in virtual tables. Carver is disabled by default and requires configuration to setup (so that you still get safety by default). I have a blog post here: http://www.metalliccode.com/carving/ that covers the basics of configuring carver.
👍 1
Also if you need this feature in someway and cannot configure carver with your infra, yo could build an extension table to do it for you.