github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-06-28 03:01:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

Osquery doc fixes (#135848)

Browse source 
* add fim link

* resolve doc issues
This commit is contained in:
Melissa Burpo 2022-07-06 16:42:21 -05:00 • committed by GitHub
parent a3b2757e4e
commit 6f3c03abab
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/osquery/osquery-faq.asciidoc
View file

@ -57,7 +57,7 @@ https://osquery.readthedocs.io/en/stable/deployment/extensions/[Osquery extensio
Yes, you can set up Yes, you can set up
https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/[Osquery FIM] using https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/[Osquery FIM] using
the Advanced configuration option for Osquery Manager (see <<osquery-custom-config>>). the Advanced configuration option for Osquery Manager (see <<osquery-custom-config>>).
However, Elastic also provides a File Integrity Monitoring integration for Elastic Agent, which might prove However, Elastic also provides a https://docs.elastic.co/en/integrations/fim[File Integrity Monitoring] integration for Elastic Agent, which might prove
to be easier to configure than the current options available for Osquery Manager. to be easier to configure than the current options available for Osquery Manager.
[float] [float]

6
docs/osquery/osquery.asciidoc
View file

@ -134,13 +134,13 @@ Once you save a query, you can only edit it from the *Saved queries* tab:
. Go to *Saved queries*, and then click **Add saved query** or the edit icon. . Go to *Saved queries*, and then click **Add saved query** or the edit icon.
. Provide the following fields: . Provide the following fields:
* The unique identifier. * The unique identifier (required).
* A brief description. * A brief description.
* The SQL query. * The SQL query (required). Osquery supports multi-line queries.
* The <<osquery-map-fields,ECS fields>> to populate when the query is run. These fields are also copied in when you add this query to a pack. * The <<osquery-map-fields,ECS fields>> to populate when the query is run (optional). These fields are also copied in when you add this query to a pack.
* The defaults to set when you add the query to a pack. * The defaults to set when you add the query to a pack.