nyanshak
12/14/2020, 6:50 PMfleetctl get carves --help
, I don't see any help text for:
• --stdout / --outfile (so I don't know those options exist)
• and I know the docs exist and mention tar out, but it took me a minute to figure out that carves would be in a tar archivezwass
fleetctl get carve --help
. The other thing I'm not sure we mention is that compression can be enabled on the osquery side and it will be zstandard compression on top of the tar archive.nyanshak
12/14/2020, 6:54 PMzwass
fleetctl get carves
nyanshak
12/14/2020, 6:56 PMzwass
nyanshak
12/14/2020, 6:58 PMzwass