nyanshak
12/18/2020, 10:20 PMfleetctl get carves
, I don't have any context on:
• which host executed the query
• what the query was
So I can basically see... "kolide_distributed_query_19" and when the carve was returned. But I don't know which machine returned the file.{
"host": "<hostname>",
"rows": []
}
Even if files are returned... I see empty rows. It would be useful to see something like how many files were returned maybeSELECT * FROM carves WHERE path LIKE '/some/path/%' AND carve=1;
OR
SELECT carve(path) FROM file WHERE directory LIKE '/some/path/%' AND mode='0755' AND type='regular';
zwass
12/19/2020, 12:19 AM[]
(no rows) for example is what osquery returns when a carve is initiated via live query, and the carve API doesn't allow us to pass any metadata through with the carve results besides for whatever is in the query name. I think what we are going to have to do is make a higher level carves concept in Fleet that will shuffle around some of the metadata on the backend and display more useful feedback to the user.SELECT * FROM carves WHERE carve=1 AND path IN (SELECT path FROM file WHERE path LIKE '/some/path/%');
nyanshak
12/19/2020, 4:03 AM$ cat /tmp/carve.txt
This is a super secret file
$ cat /tmp/carve2.txt
the most super secret carve file #2
osqueryi
Using a virtual database. Need help, type '.help'
osquery> select path from file where path LIKE "/tmp/carve%";
+-----------------+
| path |
+-----------------+
| /tmp/carve.txt |
| /tmp/carve/ |
| /tmp/carve2.txt |
| /tmp/carve3.txt |
+-----------------+
$ fleetctl query --hosts "myhost" --query 'SELECT * FROM carves WHERE carve = 1 AND path IN (SELECT path FROM file WHERE path LIKE "/tmp/carve%";' --context default
{"host":"myhost","rows":[]}
100% responded (100% online) | 1/1 targeted hosts (1/1 online)
$ fleetctl get carves --context default
No carves found
$ fleetctl query --hosts "myhost" --query 'SELECT * FROM carves WHERE carve = 1 AND path = "/tmp/carve.txt";' --context default
{"host":"myhost","rows":[]}
$ fleetctl get carves --context default
+----+-------------------------------+----------------------------+------------+------------+
| ID | CREATED AT | REQUEST ID | CARVE SIZE | COMPLETION |
+----+-------------------------------+----------------------------+------------+------------+
| 1 | 2020-12-18 22:01:49 -0600 CST | kolide_distributed_query_8 | 2048 | 100% |
+----+-------------------------------+----------------------------+------------+------------+
fleetctl preview
... this experiences is very nice 😄