joren
06/18/2020, 6:08 PMshell_history
support differentials? E.g. if I'm running osqueryd, and it runs the following query every 15m: SELECT sh.time, uid, username, sh.history_file, sh.command FROM users JOIN shell_history sh USING (uid)
, will i get differentials, or will i get the entire history contents each time, unless i add a WHERE
condition thats something like WHERE sh.time > NOW() - <QUERY-INTERVAL>
Ryan
06/18/2020, 6:15 PMjoren
06/18/2020, 6:21 PMseph
06/18/2020, 6:24 PMjoren
06/18/2020, 6:26 PMterracatta
06/18/2020, 6:30 PMjoren
06/18/2020, 6:35 PMtime = 0
?(e.g. not properly set)terracatta
06/18/2020, 6:51 PMjoren
06/18/2020, 7:08 PMRyan
06/18/2020, 7:36 PMzwass
06/18/2020, 9:57 PM