https://github.com/osquery/osquery logo
#kolide
Title
# kolide
s

Seán O'Halloran

03/30/2020, 9:35 PM
Do ATC tables work in Fleet? Running
Copy code
select value from osquery_flags where name='config_path'
gives
Copy code
/var/osquery/custom_tables.json
Which I’ve attached. This works when run locally with osqueryi, but does not work when run via the Fleet interface:
Copy code
select * from quarantine_items LIMIT 1;
Is there something I’m missing?
z

zwass

03/30/2020, 9:37 PM
You likely have osquery configured to use the
tls
config plugin. This means it won't read any config off disk. You should try adding your atc entries to the config Fleet serves.
s

Seán O'Halloran

03/30/2020, 9:48 PM
Ahh that makes sense!
8 Views