https://github.com/osquery/osquery logo
#core
Title
# core
d

defensivedepth

02/16/2021, 7:02 PM
would appreciate feedback
m

Mike Myers

02/17/2021, 2:41 AM
It looks good to me. What's a quick way to generate some Windows events?
quick way to generate some Windows events?
Nevermind, got it. My problem was that you have to explicitly enable the event subscriber and publisher with osquery flags:
osqueryi.exe --disable_events=false --windows_event_channels="System,Application,Setup,Security" --enable_windows_events_publisher=true --enable_windows_events_subscriber=true
Yea, so I tested with it a bit and it works for me (
windows 10
)
j

Juan Alvarez

02/17/2021, 9:46 AM
That person is me, and yes, he made my day 😄 I was actually trying to compile something myself but i was getting lost in my noobness
😆 1
i am happy to test it in several environments when ready
I was watching the office hours video, wondering if we will be lucky enough to get this through in 4.7.0?
d

defensivedepth

02/17/2021, 1:41 PM
Thanks @Mike Myers! I committed a fix for the formatting issues. Havent really done much dev outside of Python & Powershell 🙂
🆒 1
@Juan Alvarez would love to see it in 4.7 as well, we will see
j

Juan Alvarez

02/17/2021, 1:52 PM
I was trying to download the MSI from the pipelines to test, but it didn’t seem available yet. Then I have some env with WEC enabled to test it out if it helps
8 Views