https://github.com/osquery/osquery logo
Title
s

Seán O'Halloran

03/30/2020, 9:35 PM
Do ATC tables work in Fleet? Running
select value from osquery_flags where name='config_path'
gives
/var/osquery/custom_tables.json
Which I’ve attached. This works when run locally with osqueryi, but does not work when run via the Fleet interface:
select * from quarantine_items LIMIT 1;
Is there something I’m missing?
z

zwass

03/30/2020, 9:37 PM
You likely have osquery configured to use the
tls
config plugin. This means it won't read any config off disk. You should try adding your atc entries to the config Fleet serves.
s

Seán O'Halloran

03/30/2020, 9:48 PM
Ahh that makes sense!