Rename files-from-proc to process-files.

2023-02-23 17:11:35 -05:00 · 2023-02-23 17:11:35 -05:00 · 8ce348dfc4
parent c8ecc36079
commit 8ce348dfc4
1 changed files with 2 additions and 2 deletions
--- a/incident_response/files-from-proc.sql
+++ b/incident_response/files-from-proc.sql
@ -1,11 +1,11 @@
-- Returns a list of file information from / (non-hidden only)
+-- Returns information about running processes(non-hidden only)
 --
 -- tags: postmortem
 -- platform: linux
 SELECT GROUP_CONCAT(processes.pid) AS processes,
 GROUP_CONCAT(processes.name) AS names,
 file.*, hash.sha256,
-magic.*
+magic.data
 FROM processes
 LEFT JOIN file ON processes.path = file.path
 LEFT JOIN hash ON processes.path = hash.path