Title
#general
n

nebi

07/15/2018, 9:38 PM
Hi All, Is there anyway to know process name from process id in osquery?
p

Prakhar

07/16/2018, 6:01 AM
Yes. If your are using processes table, you can do "SELECT p.name from processes as p where p.pid = [PROCESS_ID]". In case, you are using process_events table, you can use path column and extract the process name from it.