Seán O'Halloran

Seán O'Halloran

03/30/2020, 9:35 PM
Do ATC tables work in Fleet? Running
select value from osquery_flags where name='config_path'
Which I’ve attached. This works when run locally with osqueryi, but does not work when run via the Fleet interface:
select * from quarantine_items LIMIT 1;
Is there something I’m missing?


03/30/2020, 9:37 PM
You likely have osquery configured to use the
config plugin. This means it won't read any config off disk. You should try adding your atc entries to the config Fleet serves.
Seán O'Halloran

Seán O'Halloran

03/30/2020, 9:48 PM
Ahh that makes sense!