osquery-python
osquery-python copied to clipboard
No required column support for table plugin
It's seems that the table plugin doesn't support complex stuff like required columns. After some investigation, it looks like the thrift api doesn't support this - although I was able to set a column as required (changed the column's "op" to 2), the context always stays the same so I can't use the where clause to return only a subset of rows. Am I missing something?
Any update on this ticket please. thanks a lot.
i'm new to this. but i was trying to make a path as required. and also has the ability to do where path like "/tmp/%" but i noticed it was getting this as is and not as a regex so i had to overcome this by joining file table. appreciate any advice.