Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
awallaby
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#general
Title
m
mikermcneil
02/08/2022, 8:57 PM
Does anyone know if
is_active
on the
running_apps
table is cached?
https://osquery.io/schema/5.1.0/#running_apps
(Seeing out of date results when testing from a macOS device)
s
seph
02/08/2022, 9:19 PM
Gotta check source for this 🙂
https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/darwin/running_apps.mm#L43
Looks like it’s whatever the underlying macOS API returns.
m
mikermcneil
02/11/2022, 10:59 PM
Got it, thank you!
3 Views
Post