---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create a check definition

# Create a check definition {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create a check definition to execute the `osquery` command on the Agent.

## Before you begin

Role required: agent_client_collector_integration or agent_client_collector_admin

## Procedure

1. In an Event Management instance, navigate to Agent Client CollectorCheck Definitions.
2. Click New.
3. In the Name field, enter <kbd class="ph userinput">util.osquery</kbd>.
4. In the Check type field, enter <kbd class="ph userinput">osquery</kbd>.
5. In the Command field, enter the following script:  

       osqueryi  --logger_min_status 1 --json "{{.labels.params_query}} "

6. In the Plugins field, enter the <kbd class="ph userinput">osquery</kbd> plugin.
7. In the Parameters section, enter the following values for a check parameter definition.

   | Column | Value |
   | Name | query |
   | Default value | select \* from logged_in_users |
   | Mandatory | true |
   |-|-|

   {#acc-api-check-def__choicetable_dhh_xjg_3kb}
8. Click Test check and select one of the available agents.  
   The test result appears, indicating its success or failure.

*[\>]: and then