Built off the open source project Osquery
Description: Linux and macOS X login information
What the Data Shows: The last
table in Osquery provides login and logout events for Linux and Mac OS X systems whilst providing the process id and the connecting host.
SQL: The following query joins the processes
table to get the entry process name showing all sessions with a host identifier.
You can modify this query further to grab only external IP addresses.
AND host NOT IN (':1', '127.0.0.1')
Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.