Osquery scheduled results

Scheduled queries can be run at a given interval. This can be quite useful for example, checking that configuration of an asset hasn’t changed.

../_images/osquery_scheduled.png

  • Code Once clicked will show you a preview of the running query.

  • Name The name of the query.

  • Results The total number of results that have been returned.

  • Interval The time in seconds between each run of the query.

  • Active? Shows whether the query is running or not. The query can be disabled and resumed at any time just by clicking this button.

  • Created The date of when the query was created.

  • Updated The date of when the query was last updated. This may be due to the active state being changed or the queries name.

  • Last event The date and time of the last event we saw for this query. This field is updated in real-time.

  • Actions These are changes that can be applied to the query.

    • CLONE Clones they query including its current state. Note that the results of the cloned query are not copied over.

    • DELETE Removes the query. Please note that queries are not deleted immediately. However, the results are. Queries will remain within the system for 30 days and are then deleted thereafter.