defensivedepth
09/20/2021, 1:04 PMJuan Alvarez
09/20/2021, 1:39 PMStefano Bonicatti
09/20/2021, 2:58 PM.etl
file, then it cannot be subscribed to, so no events will be generated that osquery can catch.
Maybe though those can be queried via the windows_eventlog
table.Juan Alvarez
09/20/2021, 3:22 PMosquery> SELECT * FROM windows_eventlog where channel="Microsoft-Windows-DNSServer/Analytical";
W0921 17:39:11.236779 5024 windows_eventlog.cpp:294] Failed to search event log for query with 50
Maybe am i missing something? Or i just hit a limitation?