wennan.he
01/14/2023, 2:29 AMKathy Satterlee
01/14/2023, 2:50 AMdistributed
plugin sends read
requests periodically to check for pending queries, then sends a write
request with the results. All communication with Fleet is initiated by the host.
https://osquery.readthedocs.io/en/stable/deployment/remote/#distributed-querieswennan.he
01/14/2023, 2:58 AMKathy Satterlee
01/14/2023, 3:00 AMwennan.he
01/14/2023, 3:01 AMKathy Satterlee
01/14/2023, 3:01 AMosquery
end.wennan.he
01/14/2023, 3:07 AMdetailUpdated := false
additionalResults := make(fleet.OsqueryDistributedQueryResults)
additionalUpdated := false
labelResults := map[uint]*bool{}
policyResults := map[uint]*bool{}
none for livequeryKathy Satterlee
01/14/2023, 3:11 AMwennan.he
01/14/2023, 3:12 AMKathy Satterlee
01/14/2023, 3:22 AMosquery
code, but it looks like that happens here:
https://github.com/osquery/osquery/blob/78a8e3945e13d65d9e96e7f15074e22925aa0cbc/plugins/distributed/tls_distributed.cpp#L74
I will take some time on Monday to take a closer look!wennan.he
01/14/2023, 3:23 AM