osquery / osquery-go

Go bindings for osquery
MIT License
388 stars 79 forks source link

Add writable table support #102

Closed mharrys closed 1 year ago

mharrys commented 1 year ago

Here is a suggestion on adding writable table support (INSERT, UPDATE, DELETE) which I based on the C++ implementation.

I added a sample rwtable to test it out.

$ go build -o rwtable.ext examples/rwtable/main.go
$ osqueryi --extension rwtable.ext
osquery> SELECT * FROM rw_example_table;
osquery> INSERT INTO rw_example_table VALUES ('foo', 42);
osquery> SELECT * FROM rw_example_table;
+------+---------+
| text | integer |
+------+---------+
| foo  | 42      |
+------+---------+
osquery> INSERT INTO rw_example_table VALUES ('bar', 13);
osquery> INSERT INTO rw_example_table VALUES ('zot', 37);
osquery> SELECT * FROM rw_example_table;
+------+---------+
| text | integer |
+------+---------+
| foo  | 42      |
| bar  | 13      |
| zot  | 37      |
+------+---------+
osquery> UPDATE rw_example_table SET text='foobarzot' WHERE integer=13;
osquery> SELECT * FROM rw_example_table;
+-----------+---------+
| text      | integer |
+-----------+---------+
| foo       | 42      |
| foobarzot | 13      |
| zot       | 37      |
+-----------+---------+
osquery> DELETE FROM rw_example_table WHERE integer=42;
osquery> SELECT * FROM rw_example_table;
+-----------+---------+
| text      | integer |
+-----------+---------+
| foobarzot | 13      |
| zot       | 37      |
+-----------+---------+
osquery> DELETE FROM rw_example_table;
osquery> SELECT * FROM rw_example_table;