e g ```select from user events where path NOT IN usr bin cro osquery #general

e.g. ```select * from user_events where path NOT ...

dallendoug

03/15/2018, 8:40 PM

e.g.

Copy code

select * from user_events
where path NOT IN ('/usr/bin/crond', '/usr/sbin/cron')
limit 10;

will usually show failed ssh logins in linux.

👍 1

🍻 1