Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
awallaby
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#general
Title
# general
e
etsang
03/23/2021, 5:46 PM
how can I use pid as a key to query for file_evernts? I want to know which files a known pid has accessed and changed? I am not seeing pid as part of the file_events table returned.
j
Jocelyn Bothe
03/23/2021, 6:22 PM
https://osquery.io/schema/4.7.0/#file_events
Do you mean UID rather than PID? return * from file_events where uid is XXX
e
etsang
03/23/2021, 6:25 PM
No I was referring to process. I want to find out what a process is doing.
j
Jocelyn Bothe
03/23/2021, 6:25 PM
that's not supported by the schema
e
etsang
03/23/2021, 6:33 PM
anyone know if there is another query that can find out what files a process has access/changed?
j
Jocelyn Bothe
03/23/2021, 7:04 PM
https://osquery.io/schema/4.7.0/#process_file_events
https://osquery.io/schema/4.7.0/#process_open_files
4 Views
Post