RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-16 09:27:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

incident response: remove ever-changing columns from process table

Browse Source
This commit is contained in:
Thomas Stromberg 2023-02-23 17:12:45 -05:00
parent 8ce348dfc4
commit db792dc3c2
Failed to extract signature
1 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
incident_response/processes.sql
View File

@ -1,8 +1,25 @@
-- Currently running programs
-- Currently running programs, only the columns that are not constantly changing
--
-- tags: postmortem
-- platform: posix
SELECT
*
FROM
processes
SELECT pid,
name,
path,
cmdline,
state,
cwd,
root,
uid,
gid,
euid,
egid,
seuid,
sgid,
on_disk,
start_time,
parent,
pgroup,
threads,
nice,
cgroup_path
FROM processes