Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#kolide
Title
j
jacknagz
03/02/2020, 7:16 PM
when defining query packs, do you
have
to define a query separately and then reference by name? or can you just define the query itself
z
zwass
03/02/2020, 7:23 PM
Yes, queries must be defined separately and referenced by name. It could be interesting to allow them to be defined inline.
j
jacknagz
03/02/2020, 7:27 PM
It just makes the config file simpler IMO
there’s also no support for the bulit-in query packs right?
that are dropped on the host when osquery is installed?
z
zwass
03/02/2020, 8:41 PM
Many folks convert those query packs with
fleetctl convert
and use them.
s
seph
03/02/2020, 8:51 PM
The osquery distributed packs are highly unmaintained. Caution is recommended.
Post