钢铁侠
12/03/2018, 1:00 PMsql
select * from process_events
select socket_events.*,process_events.cmdline,process_events.cwd,process_events.pid as pepid from socket_events left join process_events on socket_events.pid=process_events.pid;
but I found that the cmdline
,cwd
,pepid
are all empty in socket_events
.for eaxmple
cmd: curl <https://osquery.io>
name": "process_events",
"@version": "1",
"columns": {
"parent": "21451",
"cwd": "\"/root\"",
"btime": "0",
"auid": "1001",
"egid": "0",
"atime": "1448209686",
"owner_gid": "0",
"owner_uid": "0",
"path": "/usr/bin/curl",
"cmdline": "curl <https://osquery.io>",
"gid": "0",
"pid": "21923",
"ctime": "1461222192",
"time": "1543840554",
"uptime": "28088276",
"mode": "0100755",
"mtime": "1448209686",
"uid": "0",
"euid": "0"
},
"name": "socket_events",
"@version": "1",
"columns": {
"pepid": "",
"local_port": "0",
"cwd": "",
"status": "unknown",
"auid": "1001",
"path": "/usr/bin/curl",
"action": "connect",
"cmdline": "",
"family": "2",
"fd": "3",
"pid": "21923",
"local_address": "",
"remote_port": "443",
"time": "1543840554",
"uptime": "28088276",
"remote_address": "54.193.126.242"
},
as you can see,the socket_events
row has the same pid with the process_events
row,but the cwd
,cmdline
,pepid
are all empty in socket_events
table. it it very strange. this Scenario has happened in all my 10 host.packetzero
12/04/2018, 4:25 PM钢铁侠
12/05/2018, 3:48 AMpacketzero
12/05/2018, 3:02 PM钢铁侠
12/06/2018, 11:17 AMevents_optimize=false
is uselessseek3r
12/06/2018, 8:04 PM钢铁侠
12/07/2018, 12:21 PM