Does anyone know if there s a lightweight way to query host

Question

Does anyone know if there s a lightweight way to query host metadata from say a YAML file on a host or something similar

Ryan · Answer

An example could be metadata about a host that is generated at provisioning time and written to a file on the host somewhere that we could query as a table

Gavin · Answer

<https github com macadmins osquery extension> File Lines table

Ryan · Answer

intriguing

Ryan · Answer

thanks for the suggestion

fritz · Answer

< Ryan> If you do not want to deal with an extension you could simply write the metadata to a plist and use the built in `plist` table

fritz · Answer

If you need it to be multi platform you can create an augeas lens and ship that lens to your devices

Ryan · Answer

Ah that s a nice one to know too though these are Linux machines not Mac

fritz · Answer

Another multi platform option is encode the data in a sqlite db and then create an ATC for that DB file

Ryan · Answer

Do you have any examples of an Augeas lens

fritz · Answer

The ATC is probably the most simple option that is multi platform

Ryan · Answer

ah yeah just reading about that now

Ryan · Answer

very interesting

Ryan · Answer

thanks

fritz · Answer

I wrote up a blog post on atcs <https blog kolide com build custom osquery tables using atc ab112a30674c>

Ryan · Answer

haha yes that s the one I was reading smile

fritz · Answer

stuck out tongue winking eye You beat me to it

fritz · Answer

Good luck let me know if you have any questions

Ryan · Answer

heheh

Ryan · Answer

thanks yeah this looks very powerful flexible

defensivedepth · Answer

If you are just targeting Linux you could write out the info you need to a sysctl parameter at deployment and then query it with the <https osquery io schema 5 0 1 system controls> table

defensivedepth · Answer

To be clear havent tried it myself but I would think it should work

seph · Answer

Or use a directory with cleverly named files as a rudimentary key value store

seph · Answer

There are some ways you can get pretty clever

Mystery Incorporated · Answer

Environment variables also work to stash and retrieve stuff but might not be great if you have a lot of stuff

Ryan · Answer

Environment variables Do you have an example of that approach

Mystery Incorporated · Answer

Yup I put some values in environment variables and I have queries like ```Windows SELECT value FROM default environment WHERE variable LIKE environment variable name here LIMIT 1``` ```Ubuntu Centos Darwin SELECT value FROM process envs WHERE key LIKE environment variable name here LIMIT 1```

Mystery Incorporated · Answer

So I can set these environment variables on any device and fetch them with a query if you control the metadata you would write it to envars instead of a file and fetch like that easy enough but I don t know if there is size limits or what

Mystery Incorporated · Answer

This allows me to tag my hosts with like a company id and such that I can query I then put the company name in a decorator query so I know which company the host belongs to for every query it responds to

Ryan · Answer

Ok sounds interesting

Ryan · Answer

When you talk about decorator queries that s the same as creating a label in Fleet interface or via Fleetctl right

Mystery Incorporated · Answer

< Ryan> nah labels in fleet return groups of hosts A decorator query in osquery is a query that executes with every single query so for every query in my case it returns username hostname and company name fetched from the envvar and it includes that with every single query executed

Ryan · Answer

ahhh right gotcha < Mystery Incorporated> that s very handy actually slightly smiling face