229 B
229 B
The incident_response queries originate from the upstream osquery project:
https://github.com/osquery/osquery/blob/master/packs/incident-response.conf
Additional tables have been added and the intervals have been modified.