Discovery

[anjalipriya]

Which part of Agent Client Collector must be configured to run osquery commands on a CI?

A. ACC Websocket Endpoint
B. Credential-less Discovery
C. Check
D. Infrastructure Patterns
E. Policies

[Dr Atul G- LNG]

Hi @anjalipriya 

@Shivalika already shared the document link. Refer that.

[Shivalika]

Hello @anjalipriya  

I dug some more into this. And below is the analysis and clear difference. So, you can go for "E" Policies. 

Explanation:

• Policies define what actions should be executed on the target Configuration Item (CI). To run osquery commands on a CI, you must configure a policy that includes the necessary queries and execution rules. Policies control the execution of osquery commands on CIs
  1
  .

Why the others are incorrect:

• A. ACC Websocket Endpoint: This is used for communication between the Agent Client Collector and ServiceNow, but it does not define the actions or queries to be executed on the CI.
• B. Credential-less Discovery: This is a method for discovering CIs without requiring credentials, but it does not involve running specific commands like osquery.
• C. Check: Checks are specific monitoring tasks or scripts that run on endpoints, but they are part of the policy configuration rather than a standalone configuration for running osquery commands.
• D. Infrastructure Patterns: These are used for discovering and mapping infrastructure components, but they do not define the execution of specific commands like osquery on CIs.

By configuring policies, you can ensure that the correct osquery commands are executed on the desired CIs. 

Kindly mark my answer as helpful and accept solution if it helped you in anyway. This will help me be recognized for the efforts and also move this questions from unsolved to solved bucket. 

Regards,

Shivalika 

My LinkedIn - https://www.linkedin.com/in/shivalika-gupta-540346194

My youtube - https://youtube.com/playlist?list=PLsHuNzTdkE5Cn4PyS7HdV0Vg8JsfdgQlA&si=0WynLcOwNeEISQCY.

[Shivalika]

Hello @anjalipriya 

Please confirm if you checked my answer. Kindly mark my answer as helpful and accept solution if it helped you in anyway. This will help me be recognized for my efforts and also it can move from unsolved bucket to solved bucket. 

Regards, 

Shivalika 

My LinkedIn - https://www.linkedin.com/in/shivalika-gupta-540346194

My youtube - https://youtube.com/playlist?list=PLsHuNzTdkE5Cn4PyS7HdV0Vg8JsfdgQlA&si=0WynLcOwNeE