osquery-defense-kit/incident_response/file_events.sql

8 lines
135 B
SQL

-- Return the list of watched file events (must be configured)
--
-- tags: postmortem
-- platform: posix
SELECT
*
FROM
file_events;