Is there any way of logging in the results.log the...
# general
j
Is there any way of logging in the results.log the name of the table that the logs are from? rather than the arbitrary 'pack_xyz' identifier at the start of each result
z
Logs could come from multiple tables — typically its best to provide a name for the query in the pack that would help you identify it later
d
You can also manually tag the log at query time (see screencap), but like @zwass said, it is common for a query to
join
multiple tables
z
The logs include the "name" of the query as specified in the pack (see https://github.com/facebook/osquery/blob/experimental/packs/hardware-monitoring.conf#L3).
j
I was hoping for there to be some way of modifying a configuration parameter to include the name of the actual table in the event itself and not reliant on an arbitrary name for the query
Perhaps as a decorator of some sort?
z
This functionality doesn’t exist, but it is definitely an interesting idea.