Not able to run differential loggin on packs
When running scheduled queries from packs the results are as if i am running the queries in snapshot mode i am not able to capture differentials from queries coming from pack files. I am not sure if this is a bug or a feature.
for example in my osquery.conffile i basically have
"schedule": {
"processes": {
"query": "SELECT * FROM processes;",
"interval": 60,
"removed": false
}},
"packs": {
"packname": "C:\\Program Files\\osquery\\packs\\test_processes.conf"
}
the pack...