@groob@alessandrogario using osquery-go and trying to grab greater than and less than constraints - it looks like the constraints list is empty when I use
<
or
>
in the query - works fine when using equals or not equal to (have not tested other operators yet)
s
seph
10/28/2020, 12:26 AM
Yes… It does appear that way
seph
10/28/2020, 2:13 AM
This bug exists in python as well
seph
10/28/2020, 2:14 AM
Tested as far back as osquery 3.3.2
seph
10/28/2020, 2:15 AM
Hard to believe no one has encountered this before, but it seems that way
I suspect there’s a good chance this is true for tables as well. And that the underlying sqlite assumption is that sqlite will handle more complex operators