Title
#extensions
g

grahamgilbert

10/27/2020, 8:06 PM
@groob @alessandrogario using osquery-go and trying to grab greater than and less than constraints - it looks like the constraints list is empty when I use
<
or
>
in the query - works fine when using equals or not equal to (have not tested other operators yet)
s

seph

10/28/2020, 12:26 AM
Yes… It does appear that way
2:13 AM
This bug exists in python as well
2:14 AM
Tested as far back as osquery 3.3.2
2:15 AM
Hard to believe no one has encountered this before, but it seems that way
2:29 AM
I suspect there’s a good chance this is true for tables as well. And that the underlying sqlite assumption is that sqlite will handle more complex operators