07/09/2020, 12:34 PM
Hi Everyone, hope you all doing well. i have a question related to both osquery and kolide. if i have a query pack that i want to performance profile using osquery profile.py and then i convert it to fleet acceptable format. i see that to do a performance profile i have to use top level keyword
and to use fleet convert utility i have to change my pack to use
keyword i guess. is there something i’m missing. i tried to go through osquery doc and kolide docs and code but couldnot figure that out. https://github.com/kolide/fleet/blob/1c6ab46e40795f6bb922873ae5098f6054c1f51c/cmd/fleetctl/convert.go
3:00 PM
any thoughts on how to make the osquery pack to work with performance profiler and also fleetctl convert ??