https://github.com/osquery/osquery logo
Title
c

Chris Benninger

08/12/2020, 8:53 PM
Hi All, Can I make a specific decorator query be platform-specific? I want to provide the same decorator, but have it supplied through a different query for windoze as opposed to linux / mac
n

nyanshak

08/12/2020, 9:07 PM
I asked the same question: https://osquery.slack.com/archives/C08V7KTJB/p1597099205230900 No answers, but I maybe found a workaround for my use case (two separate queries). Maybe you could take advantage of COALESCE if all the tables are supported by all platforms though 🤷
f

fritz

08/13/2020, 12:48 PM
@Chris Benninger I do not believe this is possible due to column name collisions, can you share the two queries you are trying to have populate the same decorator and I can attempt to assist?
I know that you cannot use CASE/COALESCE logic to platform scope output unless the table is available for both platforms as mentioned by @nyanshak, even if the condition is never met (eg.
WHEN platform = 'darwin' THEN (SELECT local_hostname FROM system_info) WHEN platform = 'windows' THEN (SELECT value from registry...)
) the query planner will issue an error if a table is specified in the query plan that is not compatible with the host device.
s

seph

08/13/2020, 1:45 PM
Feels like we should support discovery queries on decorators
f

fritz

08/13/2020, 1:52 PM
That's definitely a thought @seph and sounds like the cleanest solution, I wonder if there are any reasons not to...
s

seph

08/13/2020, 1:53 PM
I've been trying to come up with a clean syntax for it.
I think this is probably a reason people have platform specific condors.
Configs
c

Chris Benninger

08/13/2020, 5:03 PM
Thanks folks!