Title
#fleet
Dan Achin

Dan Achin

04/09/2021, 11:56 PM
can anyone confirm which api endpoint is used when osquery responds to a distributed query from Fleet? I know distributed queries aren't logged, so I'm thinking that it won't be the log endpoint. Maybe /distributed/write or /distributed/read? distributed/write seems most appropriate
zwass

zwass

04/10/2021, 12:10 AM
Yes, distributed/write.
Dan Achin

Dan Achin

04/10/2021, 12:35 AM
thanks