toby1knby
01/03/2023, 1:16 PMMacAdmins osquery extension which comes conveniently bundled with Fleet's osquery installers by default
However - when i try to pull from the unified log table in fleetdm, I get a "No platforms (check your query for invalid tables or tables that are supported on different platforms)"
Any pointers on what I am doing wrong, or am I just completely missing the point?
Thanks in advance for any light you can shed om this.roberto
01/03/2023, 1:32 PMtoby1knby
01/03/2023, 1:46 PMselect * from unified_log where last="1h" and level="debug" and predicate='processImagePath contains "mdmclient"';
roberto
01/03/2023, 3:40 PMtoby1knby
01/03/2023, 3:42 PMroberto
01/03/2023, 4:01 PMunified_log
table natively recently, it might take precedence over the mac admins extension 🤔
here are the available columns: https://github.com/osquery/osquery/blob/91b2c34b5b675e493e79990bcad9f25193eb9f3b/specs/darwin/unified_log.table
can you try with some of the examples there? eg: select * from unified_log where timestamp > -1 and max_rows = 500
macadmins_unified_log
so you can have access to both tablestoby1knby
01/03/2023, 6:21 PMunified_log
to macadmins_unified_log.