Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

maybe someone here can help me?
<https://osquery.slack.com/archives/C08V7KTJB/p1667498031761929?thread_ts=1667417810.607959&amp;cid=C08V7KTJB>

<@U03EV7DDKJS> Did you add the missing comma that <@U0JFM04MS> pointed out and restart `osquery`? If you add a rule directly to the configuration file, does that rule work properly?

Can you also share what the response is when you attempt the scan?

<https://osquery.slack.com/archives/C01DXJL16D8/p1667577306951229?thread_ts=1667576895.324369&amp;cid=C01DXJL16D8>
yes

<https://osquery.slack.com/archives/C01DXJL16D8/p1667577609807479?thread_ts=1667576895.324369&amp;cid=C01DXJL16D8>
the fleet responded that no result was found

Hey <@U03EV7DDKJS>. I may have missed a response in here somewhere... are you able to scan using a rule defined in the configuration or an inline rule?

do you mean something like that?

"signatures": {
      // Each key is an arbitrary group name to give the signatures listed
      "sig_group_1": [ "/Users/wxs/sigs/foo.yar", "/Users/wxs/sigs/bar.yar" ],
      "sig_group_2": [ "/Users/wxs/sigs/baz.yar" ]
    },

And did you try this suggestion in the original thread? (I know that's relatively recent, but it's a good test!:

<https://osquery.slack.com/archives/C08V7KTJB/p1668008703107579?thread_ts=1667417810.607959&amp;cid=C08V7KTJB>

<@U02KY9FDA59>
I think that my error is because, for some reason my osquery agent get do get request to that url properly, because the conf file is valid, and I get only that two lines of error:

YARA signature url "{my ulr}" not allowed
Failed to get YARA rule url: "{my ulr}",

and that error is also happens when I give him some  fake url.

but this is strange because when I do curl "{my url}" it works.

<https://osquery.slack.com/archives/C01DXJL16D8/p1668020279991959?thread_ts=1667576895.324369&amp;cid=C01DXJL16D8>
I am at private network so I cant try it

The `not allowed` error leads me to believe that there's either still an error there or it isn't applying properly.

my only error is
Failed to get YARA rule url: "{my ulr}",
Query must specify sig_group, sigfile, or sigrule *for* scan

If you could send the updated config, that would be great! Feel free to DM it to me if you'd prefer. If you could also send me the actual url, I could test it out myself and hopefully save you some back and forth :slightly_smiling_face:

osquery.conf

I cant send you the URL, its a private network that not connected to the internet

we just tested it and it works, on http on localhost

any idea what can I do make https URL also work

is the osquery configured to use the CA that issued the certificate for the web server you are trying to reach ?

Can you try applying the config like this? (from other thread in genearl?
```"yara": { 
   "signature_urls": [
     "<https://dev.prod.rules/.*>"
   ]
 }```
