Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey! Is it possible for the scheduled query logs to list the IP of every host that comes back as a result in a query? Its hard to identify who the logs belong to

Hey <@U042XP0LJKF> how about using the *`hostIdentifier` instead?*

image.png

So <@U01EYE40QCS> this is the issue with that

Also another engineer working with me said this:
```In fact - it's worse than that. I was only seeing that on retrieval of "DNS Information" aka DNS resolvers

those were not present in all retrieved data

uuid portion of the incoming logs never changed```

oh, I was thinking more along the lines of the Fleet UUID (aka hostIdentifier), like in the sample payload:
```{
  "action": "snapshot",
  "snapshot": [
    {
      "remote_address": "0.0.0.0",
      "remote_port": "0",
      "cmdline": "/usr/sbin/syslogd"
    }
  ],
  "name": "xxxxxxx",
  "hostIdentifier": "xxxxxxx",
  "calendarTime": "xxx xxx  x xx:xx:xx xxxx UTC",
  "unixTime": "xxxxxxxxx",
  "epoch": "xxxxxxxxx",
  "counter": "x",
  "numerics": "x"
}```

is it somehow possible to get the IP address or hostname next to each result after we run a scheduled query? It will make it very easy and convenient for us since we send all logs to splunk

Screenshot 2023-09-19 at 1.24.08 PM.png

hey <@U042XP0LJKF> you can load the following as decorators on your agent options:
```- SELECT hostname AS hostname FROM system_info;```
That will give you the hostname of the device and it will appear in splunk like (see screenshot).

The agent options look like this:
```config:
  options:
    pack_delimiter: /
    logger_tls_period: 10
    distributed_plugin: tls
    disable_distributed: false
    logger_tls_endpoint: /api/osquery/log
    distributed_interval: 10
    distributed_tls_max_attempts: 3
  decorators:
    load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;```
