osQuery Management Server (Prime).Authentication Related Processes (SQLite SQL Statements)

          SELECT 
            name, 
            pid, 
            path
          FROM processes
          WHERE 
            name LIKE '%auth%' 
            OR path LIKE '%pam%' 
            OR path LIKE '%sshd%' 
            OR path LIKE '%login%' 
            OR path LIKE '%sshd_config%';