Osquery - Sql Threads

Channels

Topic	Authors	Views	Replies	Activity
All three tables has a column `hostname` that you can use to join the results on. Yes you’re right. I guess that is because the column `hostname` is not part of the table itself, it is added to every table. But I don...	a	1	1	2 weeks ago
I would expect that to work, it does on my machine. Where are you seeing those numbers? could your data pipeline be adding them? Is this osqueryi?	a	1	4	3 weeks ago
Hola, folks! I was curious if it is currently possible to query TCC statuses on macOS devices. Any insight on this is greatly appreciated 🍻	s	10	2	2 months ago
Hey all, not sure if this is possible but figured this was a good place to ask.. Looking to create a query to view the contents of a .zip file that has no password.. anyone heard of something like this? 😒lightly_smiling...	j	1	3	3 months ago
Hi, Is there a query I can use to list all the externally open sockets along with processes using them?	s	4	4	5 months ago
Hey all, I'm diving in to the implementation details of SQL in osquery to solve #7314. I see there's both some mention of sqlite, as well as `list<map<string,string&...`	w	7	4	7 months ago
Say I wanted to write a detection for "one user logged into 10k hosts at one time over SSH", how would I do that in OSQuery? • https://osquery.io/schema/5.0.1/#logged_in_users • https://osquery.io/schema/5.0.1/#users...	s	4	4	7 months ago
does anyone have a query to pull the mac address of the default network interface for windows + mac	w	2	3	1 year ago
Your SQL's intent is not immediately clear to me. Can you describe the output you are trying to get? Do you want to return results of only `rpm_packages` where an `install_time` exists?	z	2	4	1 year ago
Any example of a query to get the filevault service status on MacOS?	j	1	3	1 year ago

a
All three tables has a column
hostname
that you can use to join the results on.
Yes you’re right. I guess that is because the column
hostname
is not part of the table itself, it is added to every table. But I don...
1 Replies
2 weeks ago
s
I would expect that to work, it does on my machine. Where are you seeing those numbers? could your data pipeline be adding them? Is this osqueryi?
4 Replies
3 weeks ago
c
Hola, folks! I was curious if it is currently possible to query TCC statuses on macOS devices. Any insight on this is greatly appreciated 🍻
2 Replies
2 months ago
j
Hey all, not sure if this is possible but figured this was a good place to ask.. Looking to create a query to view the contents of a .zip file that has no password.. anyone heard of something like this? 😒lightly_smiling...
3 Replies
3 months ago
d
Hi, Is there a query I can use to list all the externally open sockets along with processes using them?
4 Replies
5 months ago
w
Hey all, I'm diving in to the implementation details of SQL in osquery to solve #7314. I see there's both some mention of sqlite, as well as
list<map<string,string&...
4 Replies
7 months ago
w
Say I wanted to write a detection for "one user logged into 10k hosts at one time over SSH", how would I do that in OSQuery? • https://osquery.io/schema/5.0.1/#logged_in_users • https://osquery.io/schema/5.0.1/#users...
4 Replies
7 months ago
w
does anyone have a query to pull the mac address of the default network interface for windows + mac
3 Replies
1 year ago
f
Your SQL's intent is not immediately clear to me. Can you describe the output you are trying to get? Do you want to return results of only
rpm_packages
where an
install_time
exists?
4 Replies
1 year ago
j
Any example of a query to get the filevault service status on MacOS?
3 Replies
1 year ago