Hello everyone,
i'am currently working with osquery (which is a requirement) for information retrieval about my hosts.
Now my issue relates to the way the osquery manager integration handles updates to the osquery config.
I'am only interested in changes to certain tables, not their entire content (i.e. each row).
This can be addressed by setting "snapshot": false, so that only additions or value changes of existing entries are queried and indexed.
However, every time i update the osquery config in the osquery manager integration, initially the queries retrieve the entire table contents once after the change.
Is there a way to supress this behavior such that the tables are not queried after the osquery configuration was changed?
Thank you!
M