Title
#core
defensivedepth

defensivedepth

02/16/2021, 7:02 PM
would appreciate feedback
Mike Myers

Mike Myers

02/17/2021, 2:41 AM
It looks good to me. What's a quick way to generate some Windows events?
3:05 AM
quick way to generate some Windows events?
Nevermind, got it. My problem was that you have to explicitly enable the event subscriber and publisher with osquery flags:
osqueryi.exe --disable_events=false --windows_event_channels="System,Application,Setup,Security" --enable_windows_events_publisher=true --enable_windows_events_subscriber=true
Yea, so I tested with it a bit and it works for me (
windows 10
)
j

Juan Alvarez

02/17/2021, 9:46 AM
That person is me, and yes, he made my day 😄 I was actually trying to compile something myself but i was getting lost in my noobness
9:50 AM
i am happy to test it in several environments when ready
10:36 AM
I was watching the office hours video, wondering if we will be lucky enough to get this through in 4.7.0?
defensivedepth

defensivedepth

02/17/2021, 1:41 PM
Thanks @Mike Myers! I committed a fix for the formatting issues. Havent really done much dev outside of Python & Powershell 🙂
1:42 PM
@Juan Alvarez would love to see it in 4.7 as well, we will see
j

Juan Alvarez

02/17/2021, 1:52 PM
I was trying to download the MSI from the pipelines to test, but it didn’t seem available yet. Then I have some env with WEC enabled to test it out if it helps