Audit and Remediation: What is Live Query?

Audit and Remediation: What is Live Query?

Environment

  • Carbon Black Cloud Console: 0.38 Release and higher
    • Audit and Remediation
  • Carbon Black Cloud Linux Sensor: 2.3.x.x and Higher
  • Carbon Black Cloud macOS Sensor: 3.3.x.x and Higher
  • Carbon Black Cloud Windows Sensor: 3.3.x.x and Higher

Question

What is Live Query?

Answer

Live Query is part of the Audit and Remediation (was CB LiveOps) offering for Carbon Black Cloud. Live Query is based on Osquery, which exposes an operating system as a high-performance relational database that can be queried for operating system data. Live Query allows the administrator to query current state/config/properties of one or more endpoints.

Additional Notes

  • Live Query uses SQL syntax to query for data, which is executed on the endpoint and returned to the backend and displayed on the Query Results page
  • Live Query results can be exported from the Console UI as a CSV file
  • Live Query results can be exported using the Audit & Remediation APIs in either JSON (default) or CSV formats

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-11-2018
Views:
1374
Contributors