Title
#windows
a

asparamancer

08/22/2019, 5:48 PM
osquery sends snapshot queries as an array to the snapshots.log file - is there a way to make it not do this?
defensivedepth

defensivedepth

08/22/2019, 5:52 PM
@asparamancer check out the
--logger_snapshot_event_type=true
flag from here: https://osquery.readthedocs.io/en/stable/installation/cli-flags/#loggingresults-flags (edited)
a

asparamancer

08/22/2019, 6:12 PM
thanks @defensivedepth that was it, conversely mac does this by default it seems do you know of a way to make it not. Changing the flag to false - even though it would be the default - doesn't have an effect
defensivedepth

defensivedepth

08/22/2019, 6:50 PM
hmmm, that seems odd. Will have to test it out on a mac
a

asparamancer

08/27/2019, 1:54 PM
fyi turns out it the =true was in the options of the pack the query was coming from, all normal