Merge pull request #195 from tstromberg/rootkit-detection

incident response: Add dump of /dev files

incident_response/files-dev.sql

@@ -0,0 +1,8 @@
+-- Returns a list of file information from /dev (non-hidden only)
+--
+-- tags: postmortem
+-- platform: posix
+SELECT *
+FROM file
+    JOIN hash ON file.path = hash.path
+WHERE file.path LIKE "/dev/%%";