Files and Processes Responsible for File State

It is possible to find the files created by a specific user and the process that created them.

Required Tables

• process_events
• file_events

Returned Fields

Query

SELECT unix_nano_timestamp,
         path,
         source_path,
         file_events.process_c8id,
         process_events.username
FROM file_events
LEFT JOIN 
    (SELECT username,
         process_c8id
    FROM process_events
    GROUP BY  process_c8id, username) AS process_events
    ON process_events.process_c8id = file_events.process_c8id
WHERE file_events.event_type=1