Title
#windows
x

xiaoliuzi

04/30/2020, 6:07 AM
osquery> select * from ntfs_journal_events WHERE action = "FileWrite"; W0430 14:07:10.305126 17384 virtual_table.cpp:967] Table ntfs_journal_events is event-based but events are disabled W0430 14:07:10.305126 17384 virtual_table.cpp:974] Please see the table documentation: https://osquery.io/schema/#ntfs_journal_events
SK

SK

04/30/2020, 6:15 AM
Hey @xiaoliuzi, probably you must set the '--disable-events=false' flag to make it work as given in the link below. https://osquery.readthedocs.io/en/stable/introduction/using-osqueryi/
x

xiaoliuzi

04/30/2020, 6:23 AM
All keyword values are -1 like this;
6:23 AM
| -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1 | | -1
SK

SK

04/30/2020, 6:36 AM
Probably this can give you some direction: https://dactiv.llc/blog/new-in-osquery-4.2/#ntfs_journal_events This is a new feature that I did not try yet.