search

osquery / osquery-go

Go bindings for osquery
MIT License
388 stars 79 forks source link

Results as map[string]interface{} rather then map[string]string #79

Closed ake-persson closed 4 years ago

ake-persson commented 4 years ago

Would it be possible to have response return the actual data type like a map[string]interface{} rather then have the value always be a string.

zwass commented 4 years ago

I believe the Thrift interface to osquery is providing us the values as strings. Perhaps we could add a helper function that attempts conversion to various types?

ake-persson commented 4 years ago

I think if this is a design because of a protocol limitation then I would just close the ticket, converting values into another type is simple enough for anyone using it and it would also require knowledge of the underlying schema.

directionless commented 4 years ago

https://github.com/kolide/osquery-go/pull/77 is a draft of the inverse, and may or may not be interesting