Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
e
ET
12/30/2020, 11:19 AMHi there
There is way to join between scheduled_tasks to username or user_id ?
s
SK
12/30/2020, 11:33 AMHello @ET I don't think there is a direct way to join this to a username or user_id, the direct connections I could find were these, maybe it can help you on your way. Each line is a possible join.
autoexec.name, scheduled_tasks.name
autoexec.name, programs.name, registry.name, scheduled_tasks.name
autoexec.name, registry.name, scheduled_tasks.name
autoexec.name, logon_sessions.logon_type, scheduled_tasks.name
autoexec.name, interface_addresses.friendly_name, interface_details.connection_id, scheduled_tasks.name
autoexec.name, scheduled_tasks.name, startup_items.name
autoexec.name, programs.name, scheduled_tasks.name
autoexec.path, scheduled_tasks.path
background_activities_moderator.last_execution_time, scheduled_tasks.last_run_timee
ET
12/30/2020, 11:35 AMNice
Do you know if can I get username from the following direct tables
s
SK
12/30/2020, 11:54 AMI'm not sure any of these tables will give you what you want, you want to know the author of the scheduled_task right?
But you should be able to JOIN to the
background_activities_moderatorLet me know if you get any results from that, curious to know if you get the desired data.
BTW interesting to know you would think that the path in both tables can be used to JOIN but the way it is represented makes it not possible.
e
ET
12/30/2020, 1:51 PMGreat let me check - Thanks a lot !
👍 1