wennan.he
01/18/2023, 7:32 PMKathy Satterlee
01/18/2023, 7:39 PMwennan.he
01/18/2023, 10:03 PMKathy Satterlee
01/18/2023, 10:19 PM--carver_start_endpoint=/api/v1/osquery/carve/begin
This endpoint tells the server the carve is incoming
--carver_continue_endpoint=/api/v1/osquery/carve/block
This is where the actual carve is sent.
By default, carves are stored in the Fleet database and removed after 24 hours.wennan.he
01/18/2023, 10:29 PM/api/v1/osquery/carve/begin
this one is used to send file?
what about this one?
--carver_continue_endpoint=/api/v1/osquery/carve/block
Kathy Satterlee
01/18/2023, 10:30 PMwennan.he
01/18/2023, 10:30 PMKathy Satterlee
01/18/2023, 10:32 PMwennan.he
01/18/2023, 10:38 PM/api/v1/osquery/carve/begin
2 the agent will run the distributed query and fetch the file
3 the agent will sent it back to fleet by
/api/v1/osquery/carve/block
is that the right order?Kathy Satterlee
01/18/2023, 10:46 PMcarves
table
2. The host receives the query and osquery starts processing
3. When osquery is ready to send the carve, it sends a request to the /begin
endpoint to start the process
4. The actual carve blocks are then sent by osquery to the /block
endpointwennan.he
01/18/2023, 10:50 PMcarves
table
this is happened on agent side right? but who told agent to activate carves feature?Kathy Satterlee
01/18/2023, 10:53 PMcarves
table, either through fleetctl
, or running a live query in the UI or REST API.carves
table (through the UI, API or fleetctl
SELECT * FROM carves WHERE path = <filepath> and carve = 1;
and carve = 1
is what tells osquery that this is a new carve.wennan.he
01/18/2023, 11:08 PMKathy Satterlee
01/18/2023, 11:09 PMwennan.he
01/18/2023, 11:11 PMKathy Satterlee
01/18/2023, 11:11 PM