osquery-defense-kit/incident_response/socket_events.sql

12 lines
171 B
SQL

-- Return the list of socket events
--
-- tags: postmortem
-- platform: posix
-- interval: 600
SELECT
*
FROM
socket_events
WHERE
time > (strftime('%s', 'now') -600)