https://github.com/osquery/osquery logo
#kolide
Title
# kolide
j

Jean M

02/04/2020, 3:09 PM
Hi, does anyone know if it is possible to get the hosts that were used as target in a live query from Fleet logs? I can only find this NewDistributedQueryCampaign message but it only contains the number of hosts? (I guess this is on purpose)
z

zwass

02/04/2020, 4:33 PM
It's not logged. It would be possible to add a way to log hosts and labels targeted, however a host can join a label after a live query is started.
j

Jean M

02/04/2020, 5:18 PM
OK, thanks!
3 Views