Skip to content

Instantly share code, notes, and snippets.

@insanitybit
Created October 29, 2019 18:45
Show Gist options
  • Save insanitybit/fcda02880283bc77a0ca10090caacad6 to your computer and use it in GitHub Desktop.
Save insanitybit/fcda02880283bc77a0ca10090caacad6 to your computer and use it in GitHub Desktop.
query
{
RootBindingres0 as var(func: has(process_id)) @cascade {
uid,
node_key,
process_name
process_id
created_files {
uid,
node_key,
process_name
file_path
}
}
var(func: has(file_path)) @cascade {
uid,
node_key,
file_path
RootBindingres1 as ~created_files {
uid,
node_key,
process_name
process_id
}
}
resCoalesce as var(func: uid(RootBindingres0, RootBindingres1))
@filter((
(has(node_key))
)AND(
(eq(process_name, "firefox.exe")) OR
(eq(process_name, "chrome.exe"))
))
{
uid,
process_name,
node_key,
process_id,
created_files @filter(((has(node_key)))AND(
(NOT alloftext(file_path, "AppData") AND NOT alloftext(file_path, "tmp"))
)) {
uid,
node_key,
process_name
file_path
}
}
res(func: uid(resCoalesce), first: 1)
@filter((
(has(node_key))
)AND(
(eq(process_name, "firefox.exe")) OR
(eq(process_name, "chrome.exe"))
))
{
uid,
process_name,
node_key,
process_id,
created_files @filter((
(has(node_key))
)AND(
(NOT alloftext(file_path, "AppData") AND NOT alloftext(file_path, "tmp"))
)) {
uid,
node_key,
process_name
file_path
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment