Environment variables also work to stash and retrieve stuff but might not be great if you have a lot of stuff
11/08/2021, 11:45 AM
Environment variables? Do you have an example of that approach?
11/08/2021, 12:24 PM
Yup I put some values in environment variables and I have queries like:
Windows: SELECT value FROM default_environment WHERE variable LIKE "%environment_variable_name_here%" LIMIT 1
Ubuntu/Centos/Darwin: SELECT value FROM process_envs WHERE key LIKE "%environment_variable_name_here%" LIMIT 1
So I can set these environment variables on any device and fetch them with a query, if you control the metadata you would write it to envars instead of a file and fetch like that easy enough, but I don't know if there is size limits or what.
This allows me to tag my hosts with like a company id and such that I can query. I then put the company name in a decorator query so I know which company the host belongs to for every query it responds to.
11/09/2021, 2:49 PM
Ok, sounds interesting!
When you talk about decorator queries, that’s the same as creating a label in Fleet interface or via Fleetctl right?
11/16/2021, 12:31 AM
@Ryan nah labels in fleet return groups of hosts. A decorator query in osquery is a query that executes with every single query so for every query in my case it returns username, hostname and company name fetched from the envvar and it includes that with every single query executed
11/23/2021, 3:23 PM
ahhh right, gotcha @Mystery Incorporated that’s very handy actually 🙂