osquery-defense-kit/incident_response/es_process_events.sql

mirror of https://github.com/chainguard-dev/osquery-defense-kit
-- Dump a list of process execution events from EndpointSecurity
--
-- platform: darwin
-- tags: events extra
SELECT
  *
FROM
  es_process_events;
Add many new incident response queries 2023-02-23 14:35:38 +00:00			`-- Dump a list of process execution events from EndpointSecurity`
			`--`
			`-- platform: darwin`
Add events and extra tags to relevant event-based queries 2024-09-24 19:36:03 +00:00			`-- tags: events extra`
make reformat 2023-05-08 17:20:47 +00:00			`SELECT`
			`*`
			`FROM`
			`es_process_events;`