Retrieves recent entries from the macOS unified log

Query · osquery

-- Retrieves recent entries from the macOS unified log
--
-- tags: postmortem extra disabled
-- platform: darwin
-- interval: 1800
SELECT
  timestamp,
  pid,
  process,
  category,
  subsystem,
  message
FROM
  unified_log
WHERE
  timestamp > (strftime('%s', 'now') - 1800)
Raw source Retrieves recent entries from the macOS unified log · osquery SQL
Esc
Published by chainguard-dev/osquery-defense-kit ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
-- Retrieves recent entries from the macOS unified log
--
-- tags: postmortem extra disabled
-- platform: darwin
-- interval: 1800
SELECT
  timestamp,
  pid,
  process,
  category,
  subsystem,
  message
FROM
  unified_log
WHERE
  timestamp > (strftime('%s', 'now') - 1800)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.