Title
#kolide
harveywells

harveywells

06/30/2020, 8:03 PM
👋 I know you can specify the name of a saved query in
fleetctl
with the
--query-name
option but is it possible to pass in an entire query pack to
fleetctl
to run multiple distributed queries? I can see this being useful for IR —  and you could pipe the results of those queries into custom tooling for further parsing or automation.
zwass

zwass

06/30/2020, 10:54 PM
That wouldn't be hard to implement with a script.
harveywells

harveywells

07/01/2020, 6:19 PM
Thanks @zwass I can look to script that up. Related
fleetctl
question. When running the following distributed query,
fleetctl
returns: (fleetctl
query --hosts 1234 --query SELECT * FROM file where path like '/Users/%/Desktop/%'
{"host":"1234","rows":[]} But I can see the actual results of that query in the Fleet UI. I was running this query to make sure that the osquery had Full Disk Access but I was curious why it wouldn't print those results to my terminal.
zwass

zwass

07/01/2020, 6:20 PM
It's definitely the exact same query text in the UI vs. fleetctl?
harveywells

harveywells

07/01/2020, 6:27 PM
Yup. I also just tried
SELECT * FROM users LIMIT 1
in the UI and with
fleetctl
. I can see results in the UI but I get the following with
fleetctl
{"host":"1234","rows":[]}
 100% responded (100% online) | 1/1 targeted hosts (1/1 online)
zwass

zwass

07/01/2020, 6:30 PM
Does this happen with any host you query? Which versions of
fleet
and
fleetctl
?
harveywells

harveywells

07/01/2020, 6:31 PM
Ah. When I flank the query in double quotes it works:
fleetctl query --hosts 1234 --query "SELECT * FROM osquery_info"
6:31 PM
I wasn't doing that initially 😬
zwass

zwass

07/01/2020, 6:32 PM
Oh ha yeah shell interpolation
harveywells

harveywells

07/01/2020, 6:32 PM
🏃
6:32 PM
Sorry about that
zwass

zwass

07/01/2020, 6:32 PM
Haha no worries
6:32 PM
Glad it works!
harveywells

harveywells

07/01/2020, 6:34 PM
Me too, thank you again!