https://github.com/osquery/osquery logo
m

mikermcneil

02/08/2022, 8:57 PM
Does anyone know if
is_active
on the
running_apps
table is cached? https://osquery.io/schema/5.1.0/#running_apps
(Seeing out of date results when testing from a macOS device)
s

seph

02/08/2022, 9:19 PM
Gotta check source for this 🙂 https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/darwin/running_apps.mm#L43 Looks like it’s whatever the underlying macOS API returns.
m

mikermcneil

02/11/2022, 10:59 PM
Got it, thank you!
3 Views