01/16/2023, 11:26 AM
Hi everyone, I have been using OSQUERY for a long time but I haven’t had a need for this before until today. A friend of mine has asked is there a way to create unique unique process ID using osquery similar to the UUID. I know there is a UPID field but it’s empty. There are a sqlite query that could generate a uuid but that could make the query complex and i didn’t know how to generate one per process. Having that would be great to make sure you always have unique process similar to modern EDR tools . Thanks
@mikermcneil / @zwass would be great to see input from you on this and fleet team!


01/16/2023, 3:17 PM
Which table are you querying?


01/16/2023, 3:32 PM
Proccesses table, on mac pid = upid but on windows upid was empty. I was expecting to see a uuid that makes the proccess id unique @defensivedepth