K
11/02/2022, 9:53 PMdata
for this query:
SELECT l.port, group_concat(DISTINCT l.port) AS 'data'
FROM listening_ports AS l
WHERE l.address != "127.0.0.1"
I also see only one port, exptected 2 portszwass
11/02/2022, 10:36 PMosquery> SELECT l.port, group_concat(DISTINCT l.port) AS 'data'
...> FROM listening_ports AS l
...> WHERE l.address != "127.0.0.1"
...> ;
+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| port | data |
+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 0 | 0,8021,137,138,49154,49155,49156,49157,49158,49159,49160,49161,49162,49163,57088,5353,56647,3722,7000,5000,55285,7579,16587,62912,60499,60538,59334,3308,8412,7003,7002,6379,3307,7004,7005,9000,9001,1025,8025,3306,7001,7006,9080,9090,9443,4566,4571,1337,57621,50853,1900,60351,56723,49738,631 |
+------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Aleksandr Maus
11/05/2022, 2:01 PMBEFORE RESOLVE TYPES: HITS: []map[string]string{map[string]string{"data":"0,22,137,138,49154,49155,49156,49157,49158,49159,49160,49161,49162,49163,54923,5353,705,984,1023,1022,2049,623,849,1021,1019,111,962,1015,1017,1012,726,688,813,999,996,7000,5000,52547,53846,56430,50635,58907,50055", "port":"0"}}, COLTYPES: map[string]string{"data":"BIGINT", "port":"INTEGER"}
The value is discarded if it can’t be converted in the current implementation. Fixing osquerybeat to keep the field as is even if it can’t be converted would be a solution. Will address that.group_concat
function?SELECT cast(pid as text) text_pid from osquery_info
The column type is returned as TEXT
BEFORE RESOLVE TYPES: HITS: []map[string]string{map[string]string{"text_pid":"5551"}}, COLTYPES: map[string]string{"text_pid":"TEXT"}
group_concat
return TEXT as a type instead of BIGINT?SELECT cast(group_concat(DISTINCT port) as text) as data FROM listening_ports
in this case the field type is returned as TEXT from osquery