chainguard-dev / osqtool

Automated testing, generation & manipulation of #osquery packs
Apache License 2.0
70 stars 6 forks source link

Allow some sort of templating and/or file inclusion #2

Open tstromberg opened 2 years ago

tstromberg commented 2 years ago

Many queries contain false positives in certain environments. osqtool should offer a way to encode false positives specific to that environment, but allow a working query to be shared.

One hastily cobbled example is a query with:

--$ AND NOT exception_key IN ({{.exception_keys}})

For users not using templating, this would appear to be a comment.

osqtool users could then pass in: osqtool pack --template-vars-dir=$HOME/overrides.

This directory could then contain a YAML file named after the pack, containing:

exception_keys:
  - ls
  - garfield

I haven't put a lot of thought into this, so ideas are welcome!