Is there anyway to know process name from process id in osquery?
07/16/2018, 6:01 AM
Yes. If your are using processes table, you can do "SELECT p.name from processes as p where p.pid = [PROCESS_ID]". In case, you are using process_events table, you can use path column and extract the process name from it.