osquery-defense-kit/incident_response/socket_events.sql

11 lines
169 B
SQL

-- Return the list of socket events
--
-- tags: postmortem
-- platform: posix
-- interval: 600
SELECT
*
FROM
socket_events
WHERE time > (strftime('%s', 'now') -600)