Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
Title
d
defensivedepth
04/30/2021, 2:50 AM
@koba
live query or scheduled query results? (or both?)
k
koba
04/30/2021, 3:07 AM
just for scheduled...is fine.
@defensivedepth
d
defensivedepth
04/30/2021, 12:14 PM
The typical backend would my something like Elasticsearch, Splunk etc. You can use SQL-esque langauge with Elasticsearch if that is what you need (
https://www.elastic.co/what-is/elasticsearch-sql
). Probably the best way to do what you are asking is to either write a logger plugin (
https://osquery.readthedocs.io/en/stable/development/logger-plugins/
) or build a pipeline off the schedule queries results file.
2 Views
#fleet
Join Slack