Query to find the Process Tree
Query |
WITH pstree
AS (SELECT 0 AS LEVEL,
pid,
name,
parent,
Cast(pid AS TEXT) AS ppid,
name AS pparent
FROM processes
WHERE parent = 0
UNION ALL
SELECT LEVEL + 1,
t.pid,
t.name,
t.parent,
pstree.ppid
|| ', '
|| Cast(t.pid AS TEXT),
pstree.pparent
|| ', '
|| t.name
FROM processes t
inner join pstree
ON t.parent = pstree.pid)
SELECT *
FROM pstree; |
Related Articles
Query to find Inbound / Outbound connections on Mac
Query WITH mac_assets AS (SELECT t.upt_asset_id FROM upt_asset_tags t WHERE t.key = 'upt-mac-edr') SELECT DISTINCT pos.upt_asset_id, ps.name, pos.pid, pos.local_address, pos.remote_address, pos.local_port, pos.remote_port, CASE WHEN pos.pid = lp.pid ...
Query to find Processes Running
Processes running between certain times Query SELECT * FROM windowed_processes p WHERE p.upt_add_time >= <TIMESTAMP> AND p.upt_add_time <= <TIMESTAMP>; Example All processes running between 2018-07-18 2:00 to 2018-08-18 3:00 SELECT * FROM ...
Process_Open_Sockets v/s Socket_Events
This article explains the difference between socket information captured by Process_open_sockets and socket_events. The article is also applicable in case of processes i.e process information captured by table 'Processes' and table 'Process_events' ...
Query to find Processes delta between last 2 weeks
Query WITH last_week_processes_cmds AS ( SELECT DISTINCT upt_asset_id, name, cmdline, path FROM processes WHERE upt_day >= Cast(Date_format(current_date - interval '14' day, '%Y%m%d') AS INTEGER) AND upt_day < Cast(Date_format(current_date - interval ...
Query to find the number of Osquery restarts in a day for all hosts
Following query, run on Global database, would provide details on number of osquery restarts in a day (GMT) Query SELECT upt_hostname, Count(0) FROM processes WHERE name LIKE 'osqueryd%' AND upt_added AND upt_day = Cast(Date_format(current_date - ...