daworley
03/02/2020, 7:41 PMmounts
and usb_devices
don't seem to show what I need, and I can't find an example of how to make the disk_events
or device_partitions
queries work.
Am I barking up the wrong tree? Can osquery detect those kinds of file system events?zwass
03/02/2020, 7:50 PMselect * from disk_events
? If you're trying in osqueryi
you will need --disable_events=false
. afaict this provides the information you are looking for.daworley
03/02/2020, 7:51 PMosqueryi
so that's probably itzwass
03/02/2020, 7:51 PMosqueryi
with events disabled.daworley
03/02/2020, 7:52 PMzwass
03/02/2020, 7:55 PM