osquery-defense-kit/incident_response/running_apps_macos.sql

mirror of https://github.com/chainguard-dev/osquery-defense-kit
-- Retrieves currently running applications
--
-- tags: postmortem disabled-privacy
-- platform: darwin
SELECT
  *
FROM
  running_apps;
Add many new incident response queries 2023-02-23 14:35:38 +00:00			`-- Retrieves currently running applications`
			`--`
Add privacy-aware version of the IR rules 2023-02-24 22:47:07 +00:00			`-- tags: postmortem disabled-privacy`
Add many new incident response queries 2023-02-23 14:35:38 +00:00			`-- platform: darwin`
			`SELECT`
			`*`
			`FROM`
make reformat 2023-05-08 17:20:47 +00:00			`running_apps;`