what is the simplest way to add a custom keypair that gets returned from osquery - I want it to be a simple piece of text that is returned, can I do it with a flag or config option or do I have to build a custom table - essentially I want to be able to set a label client side so that "type" = "full" or "simple" gets returned
07/14/2022, 9:46 PM
It's harder than it seems. Custom table is one route. If there are tables, for this platform, that can read files, that's another option. (Plist on macOS, registry on windows)You could be clever with etc hosts. I'm not sure there's a simple cross platform table to abuse though
07/14/2022, 9:50 PM
hrm, thanks, I figured custom table is where I need to go, seems a bit overkill but I may be able to expand it further later I suppose.
I'd rather not rely on changing a real config file on a client or dropping an sqlite file in place somewhere.
I'm assuming that if I use the "custom extension tables using python" I need python on the target device ?
07/14/2022, 10:03 PM
Yes if you build your extension in Python you'll need python on the device. For that reason, I strongly recommend osquery-go where Go automatically builds static binaries.
07/14/2022, 10:05 PM
I will google some decorators, and hopefully not get my house repainted in the process 😉 thanks for the headsup on osquery-go !!
07/14/2022, 10:07 PM
😆 if you have control over the configs on the different hosts you could likely add a decorator that is just a