Gray Cat
04/19/2021, 8:34 PMtheopolis
04/19/2021, 8:50 PMGray Cat
04/19/2021, 9:29 PM1 {
2 "options": {
3 "config_plugin": "filesystem",
4 "logger_plugin": "filesystem",
5 "logger_path": "/mnt/logs/osquery",
6 "pidfile": "/etc/osquery/osquery.pidfile",
7 "disable_events": "false"
8 },
9 "schedule": {
10 "file_events": {
11 "query": "SELECT fe.*, u.username FROM file_events fe JOIN users u on fe.uid=u.uid
12 "interval": 10
13 }
14 },
15 "file_paths": {
16 "file_list": ["~/{user home directory}/%"]
rm -f {file}