https://github.com/osquery/osquery logo
#macos
Title
# macos
w

William Guilherme

11/18/2020, 11:28 PM
Hi #general I am trying to build a query to evaluate if the CrowdStrike agent process is running for both Big Sur and previous OS, but I am not being very successful. Here is the query I've built:
SELECT * FROM processes WHERE name='com.crowdstrike.falcon.Agent' OR 'falcond' AND (state='R' OR '82');
The process name com.crowdstrike.falcon.Agent is only present in BigSur but not in previous OS versions. Previous OSs, the process is called falcond. In other words, I need to be able to evaluate which one is true, but the above query is only working in BigSur. Any ideas on how to improve this query? Thank you
z

zwass

11/18/2020, 11:30 PM
Maybe you're looking for
SELECT * FROM processes WHERE name IN ('com.crowdstrike.falcon.Agent', 'falcond') AND state IN ('R', '82');
✔️ 1
w

William Guilherme

11/18/2020, 11:40 PM
Thank you @zwass That's exactly it. It worked like a charm. Thank you sir. Much appreciated 😉
🍻 1
f

fritz

11/19/2020, 1:03 AM
@William Guilherme, @zwass gave you the right answer. Just so that you know the reason that your original query was not working as you intended; you need to discretely specify the column for any
OR
condition. So where you have
AND (state='R' OR '82')
if you wanted to use
OR
instead of
IN
you would need to write:
AND (state='R' OR state ='82')
💪🏽 1
1
w

William Guilherme

11/19/2020, 1:08 AM
Thank you @fritz Much appreciated mate.
👍 1
3 Views