I’ve been itching to write a plugin table that tal...
# general
I’ve been itching to write a plugin table that talks to WMI 😄
Is that you that is trying to write this?
Why not in core? 😄 ❤️ Please don't say lockdown >.>
go has a decent library for WMI i think
I dont like sticking things in core until they’re proven both in terms of need and in terms of stability of the APIs I’m calling
😍 1
@thor check out some of the crazy tables @fritz has been adding lately 😄 https://github.com/kolide/launcher/pulls
Ah I see. Nah I meant like, I'd really love to have a way of speaking to WMI directly via osquery, so gut how we currently do things, and make an interface table or something that just passes queries through directly to WMI. The hardest part that I could never really sort out is the dynamic typing of things coming back. We could do it with just everything presumed to be a string, and then handle the typing on the backend, but I've never liked that answer. That being said, I also don't super love the current WMI abstraction either 😕
I would love to see an interface similar to mdfind's current implementation of passing a query. Typing doesn't worry me so long as you could cast the results, (ATC returns everything as strings)
I wonder if you could return whatever the results were as just a JSON blob?
Possibly. Might be something worth taking a stab at....
The advantage to that is you wouldn't lose potential relational context by flattening everything into strings
Which is something the
table currently suffers from when you deal with some nested items