https://github.com/osquery/osquery logo
Title
o

oneiroi

08/22/2022, 12:54 PM
Hi all, working on improving some checks for our deployed endpoint , to check if an application feature is enabled or disabled, we need to inspect a file for :
...
"actual" : "on",
...
When the feature is disabled we get:
...
"actual" : "off(reason=disabledManually)",
...
Any direction on how to check the value of a line in a file, I suspect we may need carves enabling but am keen to hear if there are alternatives, thank you in advance 🙇‍♂️
s

sharvil

08/22/2022, 1:07 PM
hey @oneiroi, carving would definitely work, but depending on how the file is structured: one could write an augeas lens or a yara signature to match on that
o

oneiroi

08/22/2022, 1:10 PM
🤔 thanks @sharvil
z

zwass

08/22/2022, 3:28 PM
You could also use the
file_lines
table (https://github.com/macadmins/osquery-extension/blob/main/main.go#L53) from the macadmins extension. If you are using Orbit, this is bundled already.
o

oneiroi

09/02/2022, 2:34 PM
To update this thread, the solution chosen would be to employ the use of
augeas
table, ensuring the appropriate augeas lense is present to parse the json file in question; currently this is planned future work;