thor
osqueryi "select * from windows_events" > my_file.txt"
?A Conno
06/18/2019, 6:30 PMthor
windows_events
is an event based table, meaning osquery has to be running interactively, so either dropping to the shell or running as the daemon, before any data will be generatedA Conno
06/18/2019, 6:35 PMthor
A Conno
06/18/2019, 9:56 PMthor