Where can I put in a request/suggestion for a new table?

Hey @Ari Weinberg! What kind of table are you looking for? Odds are that the osquery repo will be the place to go, but if you tell me what you're looking for, I may be able to help out.

There are currently a few puppet tables bundled together with the orbit osquery package. I was wondering if it would be a benefit to add one more that queries puppet facts from the puppet facter

Definitely a good place to ask 🙂 What kind of data would you like to be able to grab from that table? How do you usually gather that data? What impact would this have on your workflow?

There is a large overlap between the data in puppet facts, and data already available through other tables, but there is some data provided that isn't. Also, the real benefit would be the custom facts, which are defined in puppet, and can be just about anything, and are usually specific to the organization. the data is usually gathered by running

facter -p

on a host with the puppet agent. the data returned is already in key-value format, and should be pretty easy to parse. This would be really helpful to query across the fleet for specific machines that have specific values in the fact database.

Thanks for the detail! I'll bring this to the team for consideration.

TYSM!

We haven't gotten it on the board as of yet - Feature requests are a bit backed up at the moment. Sorry, @Ari Weinberg!

Totally understandable. Thanks for your help!

This just stood out to me:

his would be really helpful to query across the fleet for specific machines that have specific values in the fact database.

Is that data stored locally in a database? If so, we could be in business real quick.

Not exactly a database, but more like JSON or Key:value pairs. as an example, here is a snippet of what I get when I run `facter`:

aio_agent_version => 5.5.10
augeas => {
  version => "1.10.1"
}
disks => {
  sda => {
    model => "VBOX HARDDISK",
    size => "60.00 GiB",
    size_bytes => 64424509440,
    vendor => "ATA"
  }
}
dmi => {
  bios => {
    release_date => "12/01/2006",
    vendor => "innotek GmbH",
    version => "VirtualBox"
  },
  board => {
    manufacturer => "Oracle Corporation",
    product => "VirtualBox",
    serial_number => "0"
  },
  chassis => {
    type => "Other"
  },
  manufacturer => "innotek GmbH",
  product => {
    name => "VirtualBox",
    serial_number => "0",
    uuid => "717C9420-019D-2448-A449-6D0501707087"
  }
}
facterversion => 3.11.7
filesystems => ext2,ext3,ext4,squashfs,vfat
fips_enabled => false
hypervisors => {
  virtualbox => {
    revision => "155176",
    version => "7.0.6"
  }
}

Darn. I was hoping that we'd be able to use Auto Table Construction to grab data from a local database.

ah well.

It might be worth chatting with the folks who manage the MacAdmins extension (that's where we're getting the puppet tables)

That table seems to already exist in the extension

Ah. We must have pulled it for some reason.

?

Maybe we aren't including it because it doesn't contain all of the information.