harveywells
06/30/2020, 8:03 PMfleetctl
with the --query-name
option but is it possible to pass in an entire query pack to fleetctl
to run multiple distributed queries? I can see this being useful for IR — and you could pipe the results of those queries into custom tooling for further parsing or automation.zwass
06/30/2020, 10:54 PMharveywells
07/01/2020, 6:19 PMfleetctl
question. When running the following distributed query, fleetctl
returns: (fleetctl query --hosts 1234 --query SELECT * FROM file where path like '/Users/%/Desktop/%'
{"host":"1234","rows":[]}
But I can see the actual results of that query in the Fleet UI. I was running this query to make sure that the osquery had Full Disk Access but I was curious why it wouldn't print those results to my terminal.zwass
07/01/2020, 6:20 PMharveywells
07/01/2020, 6:27 PMSELECT * FROM users LIMIT 1
in the UI and with fleetctl
. I can see results in the UI but I get the following with fleetctl
{"host":"1234","rows":[]}
100% responded (100% online) | 1/1 targeted hosts (1/1 online)
zwass
07/01/2020, 6:30 PMfleet
and fleetctl
?harveywells
07/01/2020, 6:31 PMfleetctl query --hosts 1234 --query "SELECT * FROM osquery_info"
zwass
07/01/2020, 6:32 PMharveywells
07/01/2020, 6:32 PMzwass
07/01/2020, 6:32 PMharveywells
07/01/2020, 6:34 PM