Collect recent file events

2023-05-12 16:35:00 -04:00 · 2023-05-12 16:35:00 -04:00 · 64d482abcd
parent 08d0235608
commit 64d482abcd
1 changed files with 4 additions and 4 deletions
--- a/incident_response/file_events.sql
+++ b/incident_response/file_events.sql
@ -2,7 +2,7 @@
 --
 -- tags: postmortem
 -- platform: posix
-SELECT
-  *
-FROM
-  file_events;
+-- interval: 900
+SELECT *
+FROM file_events
+WHERE time > (strftime('%s', 'now') -900)