what is the simplest way to add a custom keypair that gets returned from osquery - I want it to be a simple piece of text that is returned, can I do it with a flag or config option or do I have to build a custom table - essentially I want to be able to set a label client side so that "type" = "full" or "simple" gets returned
07/14/2022, 9:46 PM
It's harder than it seems.
Custom table is one route.
If there are tables, for this platform, that can read files, that's another option. (Plist on macOS, registry on windows)
You could be clever with etc hosts.
I'm not sure there's a simple cross platform table to abuse though
07/14/2022, 9:50 PM
hrm, thanks, I figured custom table is where I need to go, seems a bit overkill but I may be able to expand it further later I suppose.
I'd rather not rely on changing a real config file on a client or dropping an sqlite file in place somewhere.
I'm assuming that if I use the "custom extension tables using python" I need python on the target device ?
07/14/2022, 10:03 PM
Yes if you build your extension in Python you'll need python on the device. For that reason, I strongly recommend osquery-go where Go automatically builds static binaries.
07/14/2022, 10:05 PM
I will google some decorators, and hopefully not get my house repainted in the process 😉 thanks for the headsup on osquery-go !!
07/14/2022, 10:07 PM
😆 if you have control over the configs on the different hosts you could likely add a decorator that is just a
select "full" as type
select "simple" as type
and that would be added to each log from osquery
then you don't need to mess with extensions
07/14/2022, 11:42 PM
If you're willing to go as far as an extension, dropping a SQLite DB seems simpler.
07/15/2022, 5:17 PM
yeah, its a fair call, I'd just really like it to get deployed with the msi
07/15/2022, 7:53 PM
I mean… You can put a sqlitedb into the msi as easily as adjusting the flags.
I agree though — it is surprisingly hard. We’re clearly in workaround territory.