shed7
10/24/2018, 8:22 AMfile_integrity_monitoring_files
table in the kolide
db. How does one control which endpoints receive this FIM config?zwass
10/24/2018, 4:23 PMshed7
10/24/2018, 6:51 PMzwass
10/24/2018, 7:21 PMfleetctl get config
will show you the configs you have set.shed7
10/24/2018, 7:43 PMNAME:
fleetctl get - Get/list resources
USAGE:
fleetctl get command [command options] [arguments...]
COMMANDS:
queries, query, q List information about one or more queries
packs, pack, p List information about one or more packs
labels, label, l List information about one or more labels
options Retrieve the osquery configuration
enroll-secret Retrieve the osquery enroll secret
get options
lists the FIM pathszwass
10/24/2018, 7:52 PMfleetctl get options
is what you need. You can set the options separately by platform as described in the docs.