when defining query packs, do you have to define a...
# kolidej
jacknagz
03/02/2020, 7:16 PMwhen defining query packs, do you have to define a query separately and then reference by name? or can you just define the query itself
z
zwass
03/02/2020, 7:23 PM
Yes, queries must be defined separately and referenced by name. It could be interesting to allow them to be defined inline.
j
jacknagz
03/02/2020, 7:27 PMIt just makes the config file simpler IMO
jacknagz
03/02/2020, 8:38 PMthere’s also no support for the bulit-in query packs right?
jacknagz
03/02/2020, 8:38 PMthat are dropped on the host when osquery is installed?
z
zwass
03/02/2020, 8:41 PM
Many folks convert those query packs with
fleetctl converts
seph
03/02/2020, 8:51 PM
The osquery distributed packs are highly unmaintained. Caution is recommended.