Switch interval back to 300

This commit is contained in:
Thomas Stromberg 2023-01-16 13:58:24 -05:00
parent 5db432b2c6
commit 09601ed3f0
Failed to extract signature

View File

@ -49,7 +49,7 @@ FROM process_events pe
LEFT JOIN signature ON pp.path = signature.path
LEFT JOIN signature esignature ON ppe.path = esignature.path
WHERE pe.path = '/usr/bin/xattr'
AND pe.time > (strftime('%s', 'now') -30000)
AND pe.time > (strftime('%s', 'now') -300)
AND cmd != '/usr/bin/xattr -d com.apple.quarantine /Applications/1Password.app'
AND NOT (
pe.euid > 500