https://github.com/osquery/osquery logo
Title
e

Erich Stoekl

05/14/2020, 7:35 PM
Hi Folks. Is it possible to have Labels dynamically generated based off of queries? Currently, it seems that you need to create a Label, and then any host that returns anything from the query will be added to the Label. What I want is to have Labels be generated based on the results of a query. If the query returns 'A' on one host, than that host will be added to a Label titled 'A'. If the query returns 'B' on another host, then that host is added to Label 'B'.
z

zwass

05/14/2020, 7:45 PM
That is not supported. Is your set of 'A', 'B', etc. finite?
e

Erich Stoekl

05/14/2020, 8:06 PM
yes
So I would need to manually create each label?
z

zwass

05/14/2020, 8:49 PM
Well I'd automate it with fleetctl or the fleet API.
e

Erich Stoekl

05/14/2020, 9:24 PM
Sounds good, thanks!