Title
#macos
William Guilherme

William Guilherme

11/18/2020, 11:28 PM
Hi #general I am trying to build a query to evaluate if the CrowdStrike agent process is running for both Big Sur and previous OS, but I am not being very successful. Here is the query I've built:
SELECT * FROM processes WHERE name='com.crowdstrike.falcon.Agent' OR 'falcond' AND (state='R' OR '82');
The process name com.crowdstrike.falcon.Agent is only present in BigSur but not in previous OS versions. Previous OSs, the process is called falcond. In other words, I need to be able to evaluate which one is true, but the above query is only working in BigSur. Any ideas on how to improve this query? Thank you
zwass

zwass

11/18/2020, 11:30 PM
Maybe you're looking for
SELECT * FROM processes WHERE name IN ('com.crowdstrike.falcon.Agent', 'falcond') AND state IN ('R', '82');
William Guilherme

William Guilherme

11/18/2020, 11:40 PM
Thank you @zwass That's exactly it. It worked like a charm. Thank you sir. Much appreciated 😉
f

fritz

11/19/2020, 1:03 AM
@William Guilherme, @zwass gave you the right answer. Just so that you know the reason that your original query was not working as you intended; you need to discretely specify the column for any
OR
condition. So where you have
AND (state='R' OR '82')
if you wanted to use
OR
instead of
IN
you would need to write:
AND (state='R' OR state ='82')
William Guilherme

William Guilherme

11/19/2020, 1:08 AM
Thank you @fritz Much appreciated mate.