is Osquery able to read a file content and send them as logs?
04/27/2018, 12:38 PM
Nope, we sort of resist doing this. If there’s a single file you believe everyone in the world should read and report on we can morph that content into a virtual table.
04/27/2018, 4:07 PM
Doesn't the file carver do this?
04/28/2018, 12:48 PM
i would be glad if you give some information about file carver. is it related to carves table?
04/30/2018, 4:01 PM
The file carver can do this but it is slightly more complicated to set up. @theopolis is right that we resist doing this so easily in virtual tables.Carver is disabled by default and requires configuration to setup (so that you still get safety by default). I have a blog post here: http://www.metalliccode.com/carving/ that covers the basics of configuring carver.