https://github.com/osquery/osquery logo
Title
a

Ahmed

04/19/2021, 11:52 AM
Hi folks have you tried to use like case insensitive before in fleet queries.
PRAGMA case_sensitive_like=true;
i found that osqueryi is able to run the queries fine, but when i set the query in fleet osquery agents throws this error
osqueryd[14484]: E0419 07:48:08.537770 14488 registry_factory.cpp:178] sql registry sql plugin caused exception: map::at:  key not found
z

zwass

04/19/2021, 5:19 PM
That seems like a bug in osquery? Can you verify with
--tls_dump
that Fleet is sending the appropriate configuration?