• Queries from the March SophSkills presentation

    • Approved on
    • 1 Comment
    Video: https://vimeo.com/519661823 Queries used: Queries used during SophSkills Demo DATA LAKE - List all EP and FW tables in the data lake This query will need to run against the data lake. As we add more sensors to the data lake we will be extending...
  • Application Inventory Query

    • Under Review on
    • 0 Comments
    I thought I had already published this one and if I can't find it I suspect others have that same challenge. This was from one of the videos to show how the data lake can go broad and the devices dive deep. -- Application Inventory across all devices...
  • querie with file movements, on computers, to external storage

    • Under Review on
    • 0 Comments
    It's possible ? be able to see the movements of all files on all computers to external storage.
  • Show the % free disk space - DATA LAKE

    • Under Review on
    • 1 Comment
    Please i need the query for Show the % free disk space on DATA LAKE. Its possible???? Thanks
  • Hostnames with user "Administrator" saved in Windows Credential Manager

    • Under Review on
    • 1 Comment
    We are trying to build a query to get a list of host names that have a user named Administrator in their Windows Credential Manager. We found something close that looks like it is going through the event logs looking for any time something was read from...
  • firefox_addons

    • Coming Soon on
    • 0 Comments
    Firefox addons from devices with that browser If you do not have firefox on any devices like me then you will not have any data, if someone could test that would be great. Schema: creator string Addon-supported creator string description...
  • deb_packages

    • Coming Soon on
    • 0 Comments
    A Debian " package ", or a Debian archive file, contains the executable files, libraries, and documentation associated with a particular suite of program or set of related programs. Normally, a Debian archive file has a filename that ends in . deb. ...
  • browser_plugins INFO

    • Coming Soon on
    • 0 Comments
    The browser_plugins for Microsoft EDGE information from each device. We extend the browser_plugins query results with the common decorations, generic and data lake information available for all scheduled queries. browser_plugins Scheduled Query Schema...
  • homebrew_packages

    • Coming Soon on
    • 0 Comments
    Homebrew is a free and open-source software package management system that simplifies the ... Binary packages called "bottles" provide pre-built formulae with default options. Homebrew does not honor the default privileges of /usr/local ... This query...
  • installed_applications

    • Coming Soon on
    • 0 Comments
    List installed applications Windows. This will show applications added to the windows system during the data lake period (Default is 7 days) It needs to be tested SCHEMA bundle_executable string Info properties CFBundleExecutable label...