CyberUnify
12/20/2021, 12:46 PMGavin
12/20/2021, 12:56 PMSELECT data FROM windows_eventlog WHERE channel = "Security" and eventid = "4672";
Will show results for example where
SELECT data FROM windows_eventlog
Will not it will need to be appropriately constrained.
https://github.com/osquery/osquery/blob/master/specs/windows/windows_events.table