https://github.com/osquery/osquery logo
Title
m

MarkMurdock

04/27/2021, 8:32 PM
I've got Launcher and OSQuery built and working on Windows (connected to FleetDM). Do I need to do anything special to query kolide_wmi from FleetDM? I have tried a couple of basic queries but am just getting errors. For example, a query I tried was: SELECT parent,key,value,class FROM kolide_wmi WHERE class = 'Win32_OptionalFeature'
z

zwass

04/27/2021, 8:54 PM
Assuming the host you are querying is running Launcher, I'd expect this to just work.
m

MarkMurdock

04/27/2021, 9:01 PM
That's what I assumed as well. Other standard queries appear to work, and it the kolide extension is showing up in the osquery_extensions table. Maybe I'll try some other extension queries.
f

fritz

04/27/2021, 9:10 PM
Not sure if you saw my response, but it is due to a missing column in your query.
m

MarkMurdock

04/27/2021, 10:03 PM
Ahh yes that worked. Thank you so much!
👍 1
f

fritz

04/28/2021, 12:02 AM
Happy to help! The documentation is a little sparse at times with the launcher tables, it's something we have on our radar and intend to address.