what is the simplest way to add a custom keypair that gets returned from osquery - I want it to be a simple piece of text that is returned, can I do it with a flag or config option or do I have to build a custom table - essentially I want to be able to set a label client side so that "type" = "full" or "simple" gets returned
s
seph
07/14/2022, 9:46 PM
It's harder than it seems.
Custom table is one route.
If there are tables, for this platform, that can read files, that's another option. (Plist on macOS, registry on windows)
You could be clever with etc hosts.
I'm not sure there's a simple cross platform table to abuse though
j
Jay
07/14/2022, 9:50 PM
hrm, thanks, I figured custom table is where I need to go, seems a bit overkill but I may be able to expand it further later I suppose.
I'd rather not rely on changing a real config file on a client or dropping an sqlite file in place somewhere.
I'm assuming that if I use the "custom extension tables using python" I need python on the target device ?
z
zwass
07/14/2022, 10:03 PM
Maybe decorators?
Yes if you build your extension in Python you'll need python on the device. For that reason, I strongly recommend osquery-go where Go automatically builds static binaries.
j
Jay
07/14/2022, 10:05 PM
I will google some decorators, and hopefully not get my house repainted in the process 😉 thanks for the headsup on osquery-go !!
z
zwass
07/14/2022, 10:07 PM
😆 if you have control over the configs on the different hosts you could likely add a decorator that is just a
select "full" as type
or
select "simple" as type
and that would be added to each log from osquery
👍 1
then you don't need to mess with extensions
s
seph
07/14/2022, 11:42 PM
If you're willing to go as far as an extension, dropping a SQLite DB seems simpler.
j
Jay
07/15/2022, 5:17 PM
yeah, its a fair call, I'd just really like it to get deployed with the msi
s
seph
07/15/2022, 7:53 PM
I mean… You can put a sqlitedb into the msi as easily as adjusting the flags.
I agree though — it is surprisingly hard. We’re clearly in workaround territory.