Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
m
metalgearsolid
03/30/2021, 10:20 AMHello, does anyone have experience with the
windows_eventlogselect channel from windows_eventlog where channel like '%'m
manu
03/30/2021, 12:00 PMwindows_eventlogchannelchannelwindows_eventlogosquery> select channel from windows_eventlog where channel='Microsoft-Windows-PowerShell/Operational' limit(1);
+------------------------------------------+
| channel |
+------------------------------------------+
| Microsoft-Windows-PowerShell/Operational |
+------------------------------------------+
osquery> select channel from windows_eventlog where channel like 'Microsoft-Windows-PowerShell/Operational' limit(1);
W0330 17:30:48.204026 14084 windows_eventlog.cpp:281] Query constraints are invalid: the event channel or xpath must be specified
osquery> select channel from windows_eventlog where channel like '%powershell%';
W0330 17:31:46.588500 14084 windows_eventlog.cpp:281] Query constraints are invalid: the event channel or xpath must be specifiede.g. in my conf file i added below mentioned channels to subscribe to.
--windows_event_channels=Security,Microsoft-Windows-PowerShell/Operationalm
metalgearsolid
03/30/2021, 12:27 PMThanks a lot mate, i guess the idea is that we need to specify the name of the evtlog file in channel specifically.
Just thinking it would be nice if constraints are specified in the osquery schema, i don’t believe i saw that just now when i checked