07/09/2020, 12:34 PM
Hi Everyone, hope you all doing well. i have a question related to both osquery and kolide. if i have a query pack that i want to performance profile using osquery and then i convert it to fleet acceptable format. i see that to do a performance profile i have to use top level keyword
and to use fleet convert utility i have to change my pack to use
keyword i guess. is there something i’m missing. i tried to go through osquery doc and kolide docs and code but couldnot figure that out.
any thoughts on how to make the osquery pack to work with performance profiler and also fleetctl convert ??