Returns the results from a basic OSQuery query on a remote Linux machine.
For more information read documentation at https://osquery.readthedocs.io/
OS Query
- Details
- Content
- Dependencies
- Version History
Run OS query on a linux system.
Name | Description |
---|---|
OSQueryBasicQuery | |
OSQueryOpenSockets | Deprecated. Use OSQueryBasicQuery with query='select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path <> '' or remote_address <> '';' instead. |
OSQueryLoggedInUsers | Deprecated. Use OSQueryBasicQuery with query='select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;' instead. |
OSQueryProcesses | Deprecated. Use OSQueryBasicQuery with query='select * from processes' instead. |
OSQueryUsers | Deprecated. Use OSQueryBasicQuery with query='select * from users;' instead. |
Name | Description |
---|---|
OSQueryBasicQuery | Returns the results from a basic OSQuery query on a remote Linux machine. |
OSQueryOpenSockets | Deprecated. Use OSQueryBasicQuery with query='select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path <> '' or remote_address <> '';' instead. |
OSQueryLoggedInUsers | Deprecated. Use OSQueryBasicQuery with query='select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;' instead. |
OSQueryProcesses | Deprecated. Use OSQueryBasicQuery with query='select * from processes' instead. |
OSQueryUsers | Deprecated. Use OSQueryBasicQuery with query='select * from users;' instead. |
Pack Name | Pack By |
---|---|
Common Scripts | By: Cortex XSOAR |
Base | By: Cortex XSOAR |
Pack Name | Pack By |
---|
Scripts
OSQueryLoggedInUsers
- Deprecated. Use OSQueryBasicQuery with
query='select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;'
instead.
OSQueryOpenSockets
- Deprecated. Use OSQueryBasicQuery with
query='select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path <> '' or remote_address <> '';'
instead.
OSQueryProcesses
- Deprecated. Use OSQueryBasicQuery with
query='select * from processes'
instead.
OSQueryUsers
- Deprecated. Use OSQueryBasicQuery with
query='select * from users;'
instead.
- 21035
- 21234
Download
Scripts
OSQueryOpenSockets
- Updated the Docker image to: demisto/python:2.7.18.24398.
OSQueryProcesses
- Updated the Docker image to: demisto/python:2.7.18.24398.
OSQueryUsers
- Updated the Docker image to: demisto/python:2.7.18.24398.
Scripts
OSQueryBasicQuery
- Updated the Docker image to: demisto/python:2.7.18.24398.
OSQueryLoggedInUsers
- Updated the Docker image to: demisto/python:2.7.18.24398.
Scripts
OSQueryBasicQuery
- Updated the Docker image to: demisto/python:2.7.18.24066.
OSQueryLoggedInUsers
- Updated the Docker image to: demisto/python:2.7.18.24066.
OSQueryOpenSockets
- Updated the Docker image to: demisto/python:2.7.18.24066.
OSQueryProcesses
- Updated the Docker image to: demisto/python:2.7.18.24066.
OSQueryUsers
- Updated the Docker image to: demisto/python:2.7.18.24066.
PUBLISHER
Cortex
PLATFORMS
INFO
Certification | Certified | Read more |
Supported By | Cortex | |
Created | November 9, 2020 | |
Last Release | September 13, 2022 |