osqtool

osqtool copied to clipboard

Many queries contain false positives in certain environments. `osqtool` should offer a way to encode false positives specific to that environment, but allow a working query to be shared. One...

tstromberg

This query isn't packing properly: https://github.com/chainguard-dev/osquery-defense-kit/blob/main/detection/persistence/suspicious-systemd-unit.sql Example output - look for `$blank`: ``` "suspicious-systemd-unit": { "query": "SELECT file.path, file.size, file.btime, file.ctime, file.mtime, hash.sha256, yara.* FROM file JOIN yara ON file.path...

tstromberg