Skip to content

Instantly share code, notes, and snippets.

@xorrior

xorrior/emond-examples.txt

Last active June 1, 2020 18:54
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save xorrior/80c5609e199e12755740317c9a58e55a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save xorrior/80c5609e199e12755740317c9a58e55a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. xorrior renamed this gist Jan 17, 2018. 1 changed file with 7 additions and 0 deletions.
    7 changes: 7 additions & 0 deletions osqueryd.results.log → emond-examples.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1 +1,8 @@
    Fswatch command
    fswatch -r --format="'{\"path\": \"%p\", \"timestamp\":\"%t\", \"flag\": \"%f\"}'" /etc/emond.d/rules/

    Output when event is triggered
    '{"path": "/private/etc/emond.d/rules/test.plist", "timestamp":"Tue Jan 16 21:17:24 2018", "flag": "PlatformSpecific IsFile"}'

    osquery.results.log output from event.
    {"name":"file_events","hostIdentifier":"host","calendarTime":"Thu Jan 11 07:00:10 2018 UTC","unixTime":"1515654010","epoch":"0","counter":"0","columns":{"action":"CREATED","atime":"1515653980","category":"emond","ctime":"1515653980","gid":"0","hashed":"1","inode":"1316814","md5":"b1f38ed6d9dca2d33ce733d51617e900","mode":"0644","mtime":"1515653980","sha1":"003a4a25662147ca19692dd01d2d7e06ea751c5e","sha256":"f26ee0eab108d3794426f609ccd878d7a7057e2fab3bea215152e4f35c82b0cf","size":"986","target_path":"\/private\/etc\/emond.d\/rules\/test.plist","time":"1515653983","transaction_id":"2101010","uid":"0"},"action":"added"}
  2. xorrior created this gist Jan 17, 2018.
    1 change: 1 addition & 0 deletions osqueryd.results.log
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    {"name":"file_events","hostIdentifier":"host","calendarTime":"Thu Jan 11 07:00:10 2018 UTC","unixTime":"1515654010","epoch":"0","counter":"0","columns":{"action":"CREATED","atime":"1515653980","category":"emond","ctime":"1515653980","gid":"0","hashed":"1","inode":"1316814","md5":"b1f38ed6d9dca2d33ce733d51617e900","mode":"0644","mtime":"1515653980","sha1":"003a4a25662147ca19692dd01d2d7e06ea751c5e","sha256":"f26ee0eab108d3794426f609ccd878d7a7057e2fab3bea215152e4f35c82b0cf","size":"986","target_path":"\/private\/etc\/emond.d\/rules\/test.plist","time":"1515653983","transaction_id":"2101010","uid":"0"},"action":"added"}