kolide / launcher

Osquery launcher, autoupdater, and packager
https://kolide.com/launcher
Other
506 stars 103 forks source link

Platform specific tables should be available on the wrong platforms #1175

Open directionless opened 1 year ago

directionless commented 1 year ago

Chatting with folks on Kolide Slack, we were talking about some of the ways we add some complexity when working cross platform. It's pretty common for us to get information from different places. On windows, we often need kolide_wmi or registry, while on macOS it's often an exec and plist parse.

That works out okay if we're making a check per platform. But sometimes we really want to make a single check. And this effort is stymied by the platform specificity of the tables. Because kolide_wmi is not available everywhere, it cannot easily appear in non-windows SQL. If it was a legal table, that returned nothing, we'd have more rope around CTEs and sql.

Downside, is that if you were querying a non-platform table, there'd be no feedback about what you were doing wrong. But maybe that's a place for logging.

directionless commented 8 months ago

I'm going to come at this a different way. It's a bit bigger than a small issue