Does osquery have regex_replace capability? It doesn't have a function but I feel like a combination of

concat

and

regex_match

would do the trick.

It's also got all the sqlite string functions, like https://www.sqlite.org/lang_corefunc.html#replace

In addition to the SQLite commands, there are additional osquery ones described at https://osquery.readthedocs.io/en/stable/introduction/sql/ No. We do not have a regex replace. Just regex match and regex split. You could probably fake it, though it might be cumbersome. You could PR a replace command. Might need to think about the syntax.

I wish I could PR but I'm not a developer 😞 There are some cool open-source SQL extensions here: https://github.com/nalgeon/sqlean/tree/main

There are a lot of projects out there. Integrating them, at both the software or license level can be a surprising amount of work. It’s often easier to bring in the couple of functions you want

I think I now understand what you mean. I thought the SQL in osquery is just the SQLite we know, but it's not, apparently.

It’s SQLite. But osquery adds some extensions. Same as that does.