Title
#linux
m

MaxosxOsquery

02/03/2021, 5:05 PM
#linux is it possible to read the content of the file using osquery in linux ?
Mike Myers

Mike Myers

02/03/2021, 5:24 PM
s

seph

02/03/2021, 5:35 PM
Generally speaking. osquery does not ship tables that just return file contents. You can use file carving (as Mike linked above) Augeaus may provide some options here as well
m

MaxosxOsquery

02/04/2021, 12:16 PM
select * from carves where path like '/tmp/sample' and carve=1; W0204 07:16:10.200300 14738 virtual_table.cpp:959] The carves table returns data based on the current user by default, consider JOINing against the users table W0204 07:16:10.200381 14738 virtual_table.cpp:974] Please see the table documentation: https://osquery.io/schema/#carves
12:17 PM
select * from carves where path like '/tmp/sample' and carve=1;
W0204 07:16:10.200300 14738 virtual_table.cpp:959] The carves table returns data based on the current user by default, consider JOINing against the users table
W0204 07:16:10.200381 14738 virtual_table.cpp:974] Please see the table documentation: <https://osquery.io/schema/#carves>
12:17 PM
how to join with the users table .. thr is no matching column