Audit and Remediation: Can Contents of files be Queried?

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

Can contents of files be queried?

Environment

• CB Live Query: Current Version
• Carbon Black Cloud Console: .38 Release and higher
• Carbon Black Cloud Sensor: Version 3.3 and higher
• Microsoft Windows: All Supported Versions

Resolution

Contents of files cannot be queried using LiveQuery.

Additional Information

LiveQuery uses OSQuery, and OSQuery does not support queries for file contents.