Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
awallaby
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#fleet
Title
# fleet
d
defensivedepth
04/30/2021, 2:50 AM
@koba
live query or scheduled query results? (or both?)
k
koba
04/30/2021, 3:07 AM
just for scheduled...is fine.
@defensivedepth
d
defensivedepth
04/30/2021, 12:14 PM
The typical backend would my something like Elasticsearch, Splunk etc. You can use SQL-esque langauge with Elasticsearch if that is what you need (
https://www.elastic.co/what-is/elasticsearch-sql
). Probably the best way to do what you are asking is to either write a logger plugin (
https://osquery.readthedocs.io/en/stable/development/logger-plugins/
) or build a pipeline off the schedule queries results file.
2 Views
Post