clong
08/14/2017, 10:52 PMosquery> select * from extended_attributes where directory='/Users/clong/Downloads';
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+
| path | directory | key | value | base64 |
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+
| /Users/clong/Downloads/osquery-2.5.1_14_gc2d5bf1-1.linux.x86_64.rpm | /Users/clong/Downloads | where_from | <https://files.slack.com/files-pri/T08V7PM9C-F6260G1AA/download/osquery-2.5.1_14_gc2d5bf1-1.linux.x86_64.rpm> | 0 |
+---------------------------------------------------------------------+------------------------+------------+-------------------------------------------------------------------------------------------------------------+--------+
osquery> select * from extended_attributes where path like '/Users/clong/Downloads/%';