thor
06/18/2019, 6:25 PMosqueryi "select * from windows_events" > my_file.txt"
?A Conno
06/18/2019, 6:30 PMthor
06/18/2019, 6:31 PMwindows_events
is an event based table, meaning osquery has to be running interactively, so either dropping to the shell or running as the daemon, before any data will be generatedA Conno
06/18/2019, 6:35 PMthor
06/18/2019, 6:39 PMA Conno
06/18/2019, 9:56 PMthor
06/21/2019, 3:56 AM