https://github.com/osquery/osquery logo
Title
h

harveywells

06/30/2020, 8:03 PM
👋 I know you can specify the name of a saved query in
fleetctl
with the
--query-name
option but is it possible to pass in an entire query pack to
fleetctl
to run multiple distributed queries? I can see this being useful for IR —  and you could pipe the results of those queries into custom tooling for further parsing or automation.
z

zwass

06/30/2020, 10:54 PM
That wouldn't be hard to implement with a script.
h

harveywells

07/01/2020, 6:19 PM
Thanks @zwass I can look to script that up. Related
fleetctl
question. When running the following distributed query,
fleetctl
returns: (fleetctl
query --hosts 1234 --query SELECT * FROM file where path like '/Users/%/Desktop/%'
{"host":"1234","rows":[]} But I can see the actual results of that query in the Fleet UI. I was running this query to make sure that the osquery had Full Disk Access but I was curious why it wouldn't print those results to my terminal.
z

zwass

07/01/2020, 6:20 PM
It's definitely the exact same query text in the UI vs. fleetctl?
h

harveywells

07/01/2020, 6:27 PM
Yup. I also just tried
SELECT * FROM users LIMIT 1
in the UI and with
fleetctl
. I can see results in the UI but I get the following with
fleetctl
{"host":"1234","rows":[]}
 100% responded (100% online) | 1/1 targeted hosts (1/1 online)
z

zwass

07/01/2020, 6:30 PM
Does this happen with any host you query? Which versions of
fleet
and
fleetctl
?
h

harveywells

07/01/2020, 6:31 PM
Ah. When I flank the query in double quotes it works:
fleetctl query --hosts 1234 --query "SELECT * FROM osquery_info"
I wasn't doing that initially 😬
z

zwass

07/01/2020, 6:32 PM
Oh ha yeah shell interpolation
h

harveywells

07/01/2020, 6:32 PM
🏃
Sorry about that
z

zwass

07/01/2020, 6:32 PM
Haha no worries
Glad it works!
🤘 1
h

harveywells

07/01/2020, 6:34 PM
Me too, thank you again!