Title
#general
n

nyanshak

08/10/2020, 10:40 PM
I have a question about supporting decorators cross-platform <thread>
10:41 PM
I want to pull a value from environment variables, and use it as a decorator. However, Linux / macOS use
process_envs
table and Windows uses
default_environment
(as far as I can tell).
10:42 PM
I tried to do something like:
SELECT COALESCE(
  (SELECT value from process_envs where key = 'OSQUERY_ENV'),
  (SELECT variable from default_environment where key = 'OSQUERY_ENV'),
  null
) AS env where env != '';
10:43 PM
However, perhaps predictably this failed because macOS / Linux can't run query against
default_environment
and Windows can't run queries against
process_envs
table
10:43 PM
So I'm wondering if it's safe / sane to do this instead:
{
  "decorators": {
    "load": [
      "SELECT value as env from process_envs where key = 'OSQUERY_ENV';",
      "SELECT variable as env from default_environment where key = 'OSQUERY_ENV';"
    ]
  }
}
10:44 PM
Or if there's a better way to do what I'm trying to do 😐