RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rename files-from-proc to process-files.

This commit is contained in:
Thomas Stromberg 2023-02-23 17:11:35 -05:00
parent c8ecc36079
commit 8ce348dfc4
Failed to extract signature
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
incident_response/files-from-proc.sql → incident_response/process-files.sql
View File

@ -1,11 +1,11 @@
-- Returns a list of file information from / (non-hidden only) -- Returns information about running processes(non-hidden only)
-- --
-- tags: postmortem -- tags: postmortem
-- platform: linux -- platform: linux
SELECT GROUP_CONCAT(processes.pid) AS processes, SELECT GROUP_CONCAT(processes.pid) AS processes,
GROUP_CONCAT(processes.name) AS names, GROUP_CONCAT(processes.name) AS names,
file.*, hash.sha256, file.*, hash.sha256,
magic.* magic.data
FROM processes FROM processes
LEFT JOIN file ON processes.path = file.path LEFT JOIN file ON processes.path = file.path
LEFT JOIN hash ON processes.path = hash.path LEFT JOIN hash ON processes.path = hash.path