What is a best way to support custom data in osquery ? My case is that all devices are assigned tag which is just sticker on the device, need to query that too via osquery. Any suggestions ?
s
sharvil
08/26/2023, 9:33 AM
Sort of dependent on how asset management/stickers are done. Is there a mapping between the hardware serial number/UUID? Is there a central database/internal API to query those tags/stickers? If so, there is a
curl
table that can make requests. Otherwise I think one would need to write a custom extension using something like the osquery-go SDK
s
seph
08/26/2023, 10:57 AM
Osquery can read some general things, like plists or the windows registry. So that that also be an option.
j
Jayendra
08/28/2023, 12:34 PM
In my case >90% devices are linux so plist or registry won't be helpful. I was looking for https://github.com/osquery/osquery/issues/7776 kind of solution but @sharvil’s suggestion can work for me.