shed7
10/24/2018, 8:22 AMfile_integrity_monitoring_files table in the kolide db. How does one control which endpoints receive this FIM config?zwass
shed7
10/24/2018, 6:51 PMzwass
fleetctl get config will show you the configs you have set.shed7
10/24/2018, 7:43 PMNAME:
fleetctl get - Get/list resources
USAGE:
fleetctl get command [command options] [arguments...]
COMMANDS:
queries, query, q List information about one or more queries
packs, pack, p List information about one or more packs
labels, label, l List information about one or more labels
options Retrieve the osquery configuration
enroll-secret Retrieve the osquery enroll secretshed7
10/24/2018, 7:44 PMget options lists the FIM pathsshed7
10/24/2018, 7:46 PMzwass
fleetctl get options is what you need. You can set the options separately by platform as described in the docs.