Hi all I was checking how osquery gets events from windows I

Question

Hi all I was checking how osquery gets events from windows I found that it is getting events with EVT SUBSCRIBE CALLBACK But I also saw some wmi codes in osquery But I cannot see any use of these wmi codes for event subscription Only using stringToWstring confusing include of wmi Am I right about there is no wmi event subscription but only EVT SUBSCRIBE CALLBACK Or am I missing something Thanks slightly smiling face

thor · Answer

That s right we only have two event subscribers on Windows both of which use the evt subscribe api

CAN KANSIN · Answer

relaxed