I upgraded my subs to XDR and looked to following video: https://vimeo.com/519661823
Unfortunately I do not see tables mentioned there like:
Any idea why they are missing. I know that it was kind of intro video and might be that in the meantime smth has changed. When I can find smth up to date ?
Hi Andrzej,
I suggest checking if you have enabled Data Lake uploads.
The "Created by" collumn will tell you if the query being run is a built-in query (has the Sophos Shield icon) or if the query was created by an Admin.
It looks like the queries you're inquiring about were created manually. The "Data Lake Hydration Queries result" you inquired about is as follows.
1.
SELECT name, query, interval FROM osquery_schedule
2. The "XG Tables List" and "Endpoint Tables List" can be found in the following links.
- XG FW - List all tables in the data lake
- List all endpoint tables
3. For the "Windows programs inventory" I located the following post from Karl Ackerman.
- Get an Inventory of all installed applications
