Title
#fim
m

mtremsal

02/25/2019, 8:54 PM
Hi all 👋 I've got a few FIM-related questions; any pointer would be appreciated. 🙏 For those of you who use the
inotify
-based
file_events
table, how do you handle containers? Specifically:- how do you dynamically configure osquery to apply FIM queries to new containerd containers? - how do you get container metadata, such as k8s pod and deployment info, added to each
file_event
result?
8p8c

8p8c

02/25/2019, 10:41 PM
the short answer is you don't 😦. currently it's not simple to get fim activity especially from via inotify event feed. there is not a lot of context around inotify fim events.
m

mtremsal

02/26/2019, 3:39 PM
Thanks for confirming. 👍