to clarify, i see there is no such API available - is there some other way with IPC to retrieve this list, or plans to include this in the Thrift API?

turns out a regular old query works 🙂

select tbl_name FROM sqlite_temp_master WHERE type = "table";

and

pragma table_info("<table name>")

returns all the columns

quick 'n dirty:

select sql.name AS 'from sqlite', reg.name as 'from osquery registry' FROM osquery_registry reg 
  LEFT JOIN sqlite_temp_master sql ON reg.name = sql.name 
  WHERE reg.active = 1 
  AND internal = 0
  AND registry = 'table'

good news is that

pragma table_info("<table>")

works for tables not included in

sqlite_temp_master

- so I'll just use

osquery_registry

then. thanks a lot!

or open an issue around your suggestion

The important connection we should make for folks IMO is that this information is available via queries and not a specific API

getQueryColumns

If you had a complex query, you can use that to see what columns would be returned, how they would be named, and their types as understood by SQLite.

(i wish threads had threads)

scratch that, i see there are several available tables with the

osquery_

prefix

https://github.com/osquery/osquery/pull/6811 to close the loop

.schema

and

.tables

are exactly what i need, but those do not work via the Thrift API, so I have to revert to plain ol' SQL

Baking something like that into the thrift API would be interesting. I'd love to hear about the use case driving it

in my use-case, i need to list all the available tables and constituent columns to provide autocompletion

For completion, I’ve seen implementations that use the spec files from source. But that won’t get you extensions

goquery uses

select name from osquery_registry where registry = 'table' and active = 1

to fetch the active tables for tab completion. Not sure it uses colunmns

@zwass from my readings,

PRAGMA

seems to be the only way to describe tables without using the shell builtins. how feasible is it to whitelist the

table_info

pragma in light of that PR you linked earlier? if it weakens the security stance then i can live without it

The shell builtins are probably just me being confused

ah right. it’s been awhile. The osquery tables are all “eponymous virtual tables” which means they don’t show up in the

sqlite_schema

table