From bad64813758f222b1b45e91b3a8c1809e2fbb4b7 Mon Sep 17 00:00:00 2001 From: Mike Arpaia Date: Mon, 27 Jul 2015 11:38:51 -0700 Subject: [PATCH] Update an error in the incident response pack #1398 --- packs/incident-response.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packs/incident-response.conf b/packs/incident-response.conf index a4d0f1b5..1cfd2178 100644 --- a/packs/incident-response.conf +++ b/packs/incident-response.conf @@ -140,7 +140,7 @@ "value" : "Identify processes accessing sensitive files they shouldn't" }, "logged_in_users": { - "query" : "select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, p where liu.pid = p.pid;", + "query" : "select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;", "interval" : "3600", "version" : "1.4.5", "description" : "Retrieves the list of all the currently logged in users in the target system.",