James Pickett
04/11/2023, 5:06 PMwindows_search
that uses the windows search API, similar to the darwin mdfind table. I'm considering adding in support for specifying the item attribute names in the search. Since the attributes can be dynamic I would need to use and EAV style table so it might look something like this:
osquery> SELECT * FROM windows_search WHERE attributes = 'system.itempathdisplay,system.size' AND query = 'scope=''file:C:\Users\james\Pictures\Screenshots''';
+---------+------------------------+-------------------------------------------+-------------------------------------------------+
| entity | attribute | value | query |
+--------+------------------------+-------------------------------------------+--------------------------------------------------+
| 0 | system.itempathdisplay | C:\Users\james\Pictures\Screenshots\0.png | scope='file:C:\Users\james\Pictures\Screenshots' |
| 0 | system.size | 100000000 | scope='file:C:\Users\james\Pictures\Screenshots' |
| 1 | system.itempathdisplay | C:\Users\james\Pictures\Screenshots\1.png | scope='file:C:\Users\james\Pictures\Screenshots' |
| 1 | system.size | 100000000 | scope='file:C:\Users\james\Pictures\Screenshots' |
+--------+------------------------+-------------------------------------------+--------------------------------------------------+
what do yall think?seph
04/11/2023, 5:42 PMMarcos Oviedo
04/11/2023, 5:43 PMattributes
predicate, but ideally, if nothing is provided the common ones should be used (System.ItemName, System.ItemPathDisplay, System.ItemType, etc). This will allow writing simpler queries like the one below
SELECT * FROM windows_search WHERE query = 'pattern';
James Pickett
04/11/2023, 6:01 PMMarcos Oviedo
04/20/2023, 7:35 PMJames Pickett
04/20/2023, 7:54 PMMarcos Oviedo
05/11/2023, 9:55 PMJames Pickett
05/12/2023, 3:53 PMMarcos Oviedo
05/12/2023, 8:29 PMJames Pickett
05/12/2023, 9:33 PMmax_results
(please see comment).Marcos Oviedo
05/23/2023, 4:13 PMJames Pickett
05/23/2023, 4:27 PMMarcos Oviedo
05/24/2023, 3:58 AMdate_created
and date_modified
. I left some example queries that we can use for testingJames Pickett
05/25/2023, 2:42 PMMarcos Oviedo
05/31/2023, 8:52 PMJames Pickett
05/31/2023, 8:55 PM