jitters
10/31/2017, 5:57 PMThe shell_history table returns data based on the current user by default, consider JOINing against the users table based off a query like:
select users.username, shell_history.command from shell_history join users using(uid);
I remember seeing this before and came across the issue https://github.com/facebook/osquery/issues/1277. Is it the case that I should be calling from users instead of shell_history first?