Check what's happen

1

Hi,

not that easy to to understand what’s happen in your system while a process is running.
This may help you a little.
It extracts some system parameters using osquery

  1. install osquery on your system (https://osquery.io/downloads/official/5.0.1)
  2. open the EM project attached
  3. select the tables you want to extract : select in the filter transformation of the main module
  4. run the project

it will extract some systems parameters into JSON and DSET files
as we can’t assign a specific codepage to a command line transformation in EM, there’s a little workaround to convert the query results from codepage 850 to 65001 before saving the JSON file.osquery.zip (29.1 KB)

hope it will be useful

Regards

2

Neat!

I would make a Launcher task with a fixed list parameter for the target osquery table. In this case, it would be possible to launch ad hoc queries for system data in a couple of clicks right from the Launcher.

3

could be useful in a data catalog