osquery-defense-kit/incident_response/socket_events.sql

-- Return the list of socket events
--
-- tags: postmortem events extra
-- platform: posix
-- interval: 600
SELECT
  *
FROM
  socket_events
WHERE
  time > (strftime('%s', 'now') -600)
Add many new incident response queries 2023-02-23 14:35:38 +00:00			`-- Return the list of socket events`
			`--`
Add events and extra tags to relevant event-based queries 2024-09-24 19:36:03 +00:00			`-- tags: postmortem events extra`
incident_response: Improve macOS coverage 2023-05-12 14:49:50 +00:00			`-- platform: posix`
Collect more file data 2023-05-12 20:17:10 +00:00			`-- interval: 600`
make reformat 2023-05-08 17:20:47 +00:00			`SELECT`
			`*`
			`FROM`
Fix bug 2023-05-12 20:26:44 +00:00			`socket_events`
Run reformat 2024-02-16 22:21:00 +00:00			`WHERE`
			`time > (strftime('%s', 'now') -600)`