No required column support for table plugin

osquery / osquery-python

Python bindings for osquery's Thrift API

Other

292 stars 51 forks source link

No required column support for table plugin #41

Open davidt99 opened 6 years ago

davidt99 commented 6 years ago

It's seems that the table plugin doesn't support complex stuff like required columns. After some investigation, it looks like the thrift api doesn't support this - although I was able to set a column as required (changed the column's "op" to 2), the context always stays the same so I can't use the where clause to return only a subset of rows. Am I missing something?

anelshaer commented 3 years ago

Any update on this ticket please. thanks a lot. i'm new to this. but i was trying to make a path as required. and also has the ability to do where path like "/tmp/%" but i noticed it was getting this as is and not as a regex so i had to overcome this by joining file table. appreciate any advice.