Title
#windows
j

j

03/08/2018, 1:25 AM
--host_identifier=hostname --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_tls_refresh=10 --config_tls_max_attempts=3 --enroll_tls_endpoint=/api/v1/osquery/enroll --enroll_secret_path=c:\programdata\osquery\enroll_secret --disable_distributed=false --distributed_plugin=tls --distributed_interval=10 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint=/distributed/read --distributed_tls_write_endpoint=/distributed/write --logger_plugin=tls --logger_tls_endpoint=/api/v1/osquery/log --logger_tls_period=5 --tls_hostname=x.x.x.x:8080 --tls_server_certs=c:\programdata\osquery\server.pem --utc --verbose
Kemal

Kemal

03/08/2018, 8:04 AM
@j I can’t see the flag --config_tls_refresh on osquery web site (stable) but --config_refresh exists on the site. I think when applied to the config file (oasquery.flags), works both.. documentation may be out of date @thor
1:08 PM
@j You can also see all supported flags in oquery shell (osqueryi) by the query select * from osquery_flags; and the flag config_tls_refresh isn’t exist there