osquery-defense-kit/incident_response/socket_events.sql

-- Return the list of socket events
--
-- tags: postmortem
-- platform: posix
-- interval: 600
SELECT
  *
FROM
  socket_events;
WHERE time > (strftime('%s', 'now') -600)
Add many new incident response queries 2023-02-23 14:35:38 +00:00			`-- Return the list of socket events`
			`--`
			`-- tags: postmortem`
incident_response: Improve macOS coverage 2023-05-12 14:49:50 +00:00			`-- platform: posix`
Collect more file data 2023-05-12 20:17:10 +00:00			`-- interval: 600`
make reformat 2023-05-08 17:20:47 +00:00			`SELECT`
			`*`
			`FROM`
			`socket_events;`
Collect more file data 2023-05-12 20:17:10 +00:00			`WHERE time > (strftime('%s', 'now') -600)`