Hello everyone! Faced the following problem.
We collect some parameters (such as a screensaver, disk encryption, etc.) from user machines through osquery/fleet via one query (with sub selects), and also collect information about the user’s current VPN IP address.
The question is, what is the best way to get the user’s address through osquery, knowing only the VPN pool (several subnets)?
Now I do it through interface_addresses table and match the address with a huge regex via regex_match function.
I noticed that this greatly affects the performance of the query and in some hosts it even gets into the denylist because of the CPU threshold.
Could you please tell me if there is some other way to get from the user a IP from the required subnet, if he has one?