Does osquery support

NOT EXISTS

? I'm trying to run a query for a policy that will return true if a process is not running... I;m running into issues.

It should. Can you paste the query you are trying to use?

I think one can do

1-EXISTS

trick

the problematic part is

name NOT EXISTS

, it should be

SELECT * FROM processes WHERE NOT EXISTS (SELECT name from processes WHERE name = "Google Chrome");

I'm trying to detect if chrome is NOT running

I think Michal's first example is perfect for that. For simplicity's sake, I'd change the select a little:

SELECT 1 WHERE NOT EXISTS (SELECT 1 from processes WHERE name = "Google Chrome");

That way you get your

true

without selecting data you don't need.

oh yeah, my example query was just showing more info for debugging purposes.

I cleaned up the example a little more 🙂

perfect - thanks!!

Since the whole "Double positive to prove a negative" thing is a little confusing.... IF the policy is "Google Chrome is not running" and you want a pass when it is not or a fail if it is, that's the right query.

yes, just for full clarity I'm trying to create a policy that passes if your version of Chrome is up to date OR google chrome isn't running (because you likely don't use it)

Thanks! Can never be too careful with twisty logic.

I actually did look at that one and cribbed a little from it.

Totally makes sense. I think you're querying the right thing here, assuming that you've got an integration or webhook set up for your policies so that you aren't just relying on whether they were running Chrome when the most recent policy check happened. Though if people are using Chrome it's usually always running, so that may just be a made up concern :)

you are following my thoughts exactly. The query isn't perfect but I'm most likely to catch "active" Chrome users with out of date browsers

I feel like I ran across someone before that was using a cron job to periodically query endoflife and update the policy with either the API or

fleetctl

thx!