or `SELECT FROM processes WHERE path= System Library CoreSer osquery #macos

or `SELECT * FROM processes WHERE path="/System/Li...

sean.cavanaugh

12/05/2019, 11:19 PM

SELECT * FROM processes WHERE path="/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight";