RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-02 18:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve perforance by re-ordering JOIN's

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-27 16:54:41 -04:00
parent 208383ccd6
commit 4a25a0c410
Failed to extract signature
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
detection/execution/unexpected-env-values-macos.sql
View File

@ -5,7 +5,7 @@
-- --
-- WARNING: This query is known to require a higher than average wall time. -- WARNING: This query is known to require a higher than average wall time.
-- --
-- tags: transient state rapid -- interval: 20
-- platform: darwin -- platform: darwin
SELECT SELECT
key, key,
@ -15,12 +15,14 @@ SELECT
p.cmdline, p.cmdline,
p.parent AS parent_pid, p.parent AS parent_pid,
pp.cmdline AS parent_cmd pp.cmdline AS parent_cmd
FROM -- Querying processes first and filtering by time gives a massive 20X speed improvement
process_envs pe -- over querying process_envs first and JOIN'ing against processes
LEFT JOIN processes p ON pe.pid = p.pid FROM processes p
LEFT JOIN process_envs pe ON p.pid = pe.pid
LEFT JOIN processes pp ON p.parent = pp.pid LEFT JOIN processes pp ON p.parent = pp.pid
WHERE WHERE -- This time should match the interval
( p.start_time > (strftime('%s', 'now') - 20)
AND (
key = 'HISTFILE' key = 'HISTFILE'
AND NOT VALUE LIKE '/Users/%/.%_history' AND NOT VALUE LIKE '/Users/%/.%_history'
) )