Eric G
12/21/2022, 7:43 PM{
"decorators": {
"always": [
"SELECT instance_id, region, availability_zone, local_ipv4, account_id FROM ec2_instance_metadata;"
],
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
},
"file_paths": {
"c": [
"C:\\Program Files\\osquery\\logs\\%"
]
},
"options": {
"disable_logging": "false",
"disable_tables": "",
"host_identifier": "hostname",
"verbose": "true"
},
"schedules": {
"file_events": {
"interval": 300,
"query": "SELECT * FROM ntfs_journal_events;"
}
}
}
--disable_events=false
--enable_ntfs_event_publisher=true
I1221 19:45:27.390025 2224 ntfs_event_publisher.cpp:544] FRN pathname lookup failed, trying parent: Failed to open the file in volume C:\. Error: The parameter is incorrect.
select * select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name | publisher | type | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher | 0 | 0 | 0 | 1 |
| ntfs_event_publisher | ntfs_event_publisher | publisher | 1 | 0 | 5 | 1 |
| ntfs_journal_events | ntfs_event_publisher | subscriber | 1 | 0 | 0 | 1 |
| powershell_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
| windows_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
Naveen
05/24/2023, 6:57 AM