empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Enable function-style file carving in Orbit (#3268)

Browse Source
This commit is contained in:
Zach Wasserman 2021-12-09 09:59:58 -08:00 committed by GitHub
parent 2f4ea1da85
commit a7aa14fa76
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
orbit/pkg/osquery/flags.go
View File

@ -27,6 +27,9 @@ func FleetFlags(fleetURL *url.URL) []string {
"--logger_plugin=tls",
"--logger_tls_endpoint=" + path.Join(prefix, "/api/v1/osquery/log"),
"--disable_carver=false",
// carver_disable_function is separate from disable_carver as it controls the use of file
// carving as a SQL function (eg. `SELECT carve(path) FROM processes`).
"--carver_disable_function=false",
"--carver_start_endpoint=" + path.Join(prefix, "/api/v1/osquery/carve/begin"),
"--carver_continue_endpoint=" + path.Join(prefix, "/api/v1/osquery/carve/block"),
"--carver_block_size=2000000",