https://github.com/osquery/osquery logo
#general
Title
# general
n

nyanshak

08/10/2020, 10:40 PM
I have a question about supporting decorators cross-platform <thread>
I want to pull a value from environment variables, and use it as a decorator. However, Linux / macOS use
process_envs
table and Windows uses
default_environment
(as far as I can tell).
I tried to do something like:
Copy code
SELECT COALESCE(
  (SELECT value from process_envs where key = 'OSQUERY_ENV'),
  (SELECT variable from default_environment where key = 'OSQUERY_ENV'),
  null
) AS env where env != '';
However, perhaps predictably this failed because macOS / Linux can't run query against
default_environment
and Windows can't run queries against
process_envs
table
So I'm wondering if it's safe / sane to do this instead:
Copy code
{
  "decorators": {
    "load": [
      "SELECT value as env from process_envs where key = 'OSQUERY_ENV';",
      "SELECT variable as env from default_environment where key = 'OSQUERY_ENV';"
    ]
  }
}
Or if there's a better way to do what I'm trying to do 😐
16 Views