<@U6GKV8TQQ> I believe this is due to the globbing...
# macos
f
@CptOfEvilMinions I believe this is due to the globbing function in osquery treating
.
prepends differently. That being said, you can easily get your results by using a
UNION
like below:
Copy code
SELECT * FROM file WHERE path LIKE '/Users/<username>/%' 
UNION ALL 
SELECT * FROM file WHERE path LIKE '/Users/<username>/.%';