Ah I see. Nah I meant like, I'd really love to have a way of speaking to WMI directly via osquery, so gut how we currently do things, and make an interface table or something that just passes queries through directly to WMI. The hardest part that I could never really sort out is the dynamic typing of things coming back. We could do it with just everything presumed to be a string, and then handle the typing on the backend, but I've never liked that answer. That being said, I also don't super love the current WMI abstraction either 😕
10/04/2018, 6:22 PM
I would love to see an interface similar to mdfind's current implementation of passing a query. Typing doesn't worry me so long as you could cast the results, (ATC returns everything as strings)
I wonder if you could return whatever the results were as just a JSON blob?
10/04/2018, 7:53 PM
Possibly. Might be something worth taking a stab at....
10/04/2018, 9:15 PM
The advantage to that is you wouldn't lose potential relational context by flattening everything into strings
Which is something the
table currently suffers from when you deal with some nested items