osquery-defense-kit/incident_response/shell_history.sql

10 lines
180 B
SQL

-- Retrieves the command history, per user, by parsing the shell history files.
--
-- tags: postmortem
-- platform: posix
SELECT
*
FROM
users
JOIN shell_history USING (uid);