Audit & Remediation: How To Test Osqueryi.exe On A Windows Endpoint

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

Testing osqueryi locally on a device

Environment

• Carbon Black Cloud Console: All Versions
• Microsoft Windows: All Supported Versions

Resolution

The process to test with Live Response are below.

1. Navigate to Endpoints page
2. Select Device
3. Select Go Live
4. From the Live Response Session Window
5. CD into c:\program files\confer\blades\LiveQuery\
6. Run execfg C:\Program Files\Confer\Blades\LiveQuery\osqueryi.exe