`SELECT f path h sha256 FROM file f JOIN hash h ON f path = osquery #fleet

`SELECT f.path, h.sha256 FROM file f JOIN hash h O...

Layne

09/13/2023, 9:42 PM

SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '%mcafee%';

clong

09/13/2023, 11:28 PM

In general you should try to supply a more specific path, otherwise osquery might try to scan your entire filesystem. This should help: https://www.uptycs.com/blog/wildcards-and-globbing-in-osquery

Layne

09/22/2023, 8:05 PM

thank you Clong!