https://github.com/osquery/osquery logo
Join Slack
Powered by
Does `shell_history` support differentials? E.g. i...
# general
j
Does 
shell_history
support differentials? E.g. if I'm running osqueryd, and it runs the following query every 15m: 
SELECT sh.time, uid, username, sh.history_file, sh.command FROM users JOIN shell_history sh USING (uid)
, will i get differentials, or will i get the entire history contents each time, unless i add a 
WHERE
condition thats something like 
WHERE sh.time > NOW() - <QUERY-INTERVAL>
r
good question, I also would like to know this 🙂
j
@zwass - would you be so kind to bequeath some knowledge on me? 🙂
s
Why wouldn’t it support differentials?
j
i just recall from days of old that it didnt
and theres a few tables that are like that
t
It will enumerate all the contents of shell history and if diff mode is enabled only send an update if there is more shell history
and the diff mode behavior should match the behavior of other tables that produce many rows
j
good to know 🙂 still holds true if 
time = 0
?(e.g. not properly set)
t
yeah I don't believe osquery is doing anything extra smart other than reading the history files directly and parsing them, it's not like maintaining a cursor and remembering when you queried last or anything like that.
and if a user or malware deletes the shell history (very common) or modifies it, osquery will just report back what it finds (or nothing if it was deleted)
I would also just be careful in general mass querying this data if you have a lot of terminal usage, you will inadvertently pick up credentials in clear text, not everyone is good at using interactive password prompts or will accidentally paste passwords, keys, etc.
👍 2
Risk / Reward on this table is tenuous at best
j
thanks @terracatta 🙂
r
good tips, thanks!
z
Yep, agreed @terracatta has it all right.
👍 1
8 Views
Open in Slack
PreviousNext
Powered by