Update an error in the incident response pack

osquery#1398
rklabs · Jul 27, 2015 · bad6481 · bad6481
1 parent e07b053
commit bad6481
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packs/incident-response.conf b/packs/incident-response.conf
@@ -140,7 +140,7 @@
       "value" : "Identify processes accessing sensitive files they shouldn't"
     },
     "logged_in_users": {
-      "query" : "select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, p where liu.pid = p.pid;",
+      "query" : "select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;",
       "interval" : "3600",
       "version" : "1.4.5",
       "description" : "Retrieves the list of all the currently logged in users in the target system.",