Luis Gomez
05/26/2021, 7:15 AMosquery_schedule
have a last_executed = 0
? I have enabled the osx-attack pack but no queries seem to be running, I left the default Intervals and I'm using filesystem logging. If this is not the right place to ask this let me know where thanks! :)allister
05/26/2021, 8:44 AMLuis Gomez
05/26/2021, 8:50 AM➜ ~ sudo osqueryctl status
com.facebook.osqueryd is running. pid: 10799
allister
05/26/2021, 8:52 AMLuis Gomez
05/26/2021, 8:57 AMosquery_schedule
tablelast_executed = 0
?osqueryd.results.log
which is fineallister
05/26/2021, 9:00 AMLuis Gomez
05/26/2021, 9:00 AMallister
05/26/2021, 9:01 AMLuis Gomez
05/26/2021, 9:04 AMlast_executed
column in the osquery_schedule
was doing that but not sure anymoreallister
05/26/2021, 9:49 AMLuis Gomez
05/26/2021, 10:11 AMzwass
osquery_schedule
in osqueryi
?Luis Gomez
05/26/2021, 4:02 PMSELECT * from osquery_schedule WHERE last_executed > 0 ;
running this query in osqueryi
gives nothingzwass
Luis Gomez
05/26/2021, 4:32 PMzwass
osquery_schedule
table, but that new .connect
command is a good option for ad-hoc analysis)Luis Gomez
05/26/2021, 4:44 PM