Hi everyone, I have been using OSQUERY for a long time but I haven’t had a need for this before until today. A friend of mine has asked is there a way to create unique unique process ID using osquery similar to the UUID. I know there is a UPID field but it’s empty.
There are a sqlite query that could generate a uuid but that could make the query complex and i didn’t know how to generate one per process.
Having that would be great to make sure you always have unique process similar to modern EDR tools .
@mikermcneil / @zwass would be great to see input from you on this and fleet team!
01/16/2023, 3:17 PM
Which table are you querying?
01/16/2023, 3:32 PM
Proccesses table, on mac pid = upid but on windows upid was empty. I was expecting to see a uuid that makes the proccess id unique @defensivedepth
06/14/2023, 1:52 AM
Hey @Ahmed, how did this turn out? If unresolved, maybe we could grab 15m with @Kathy Satterlee for a screenshare? Probably the fastest way to figure out what might be going on.