Is there an easy way to add an arbitrary augeas pa...
# general
d
Is there an easy way to add an arbitrary augeas path? Based on what I am seeing, I dont think there is.
j
No, you'd have to edit the lens files directly to add additional paths in current osquery.
Ideally, you'd be able to tell it which lens to use in the query.
d
Ok understood
Just trying to find an easy way to read an arbitrary file without the file carve
j
I don't think that is possible out of the box. There are extensions out there that do this. E.g.
file_lines
in https://github.com/macadmins/osquery-extension
👍 1
f
was about to say the same ^^ file_lines, json_lines etc. you sometimes can get lucky and abuse the
plist
table as afaik it is the only vanilla osquery table that reads files, but very unpredictable hack.
d
ahhh nice, will check out the plist
👍 1