osquery-python icon indicating copy to clipboard operation
osquery-python copied to clipboard

No required column support for table plugin

Open davidt99 opened this issue 8 years ago • 1 comments

It's seems that the table plugin doesn't support complex stuff like required columns. After some investigation, it looks like the thrift api doesn't support this - although I was able to set a column as required (changed the column's "op" to 2), the context always stays the same so I can't use the where clause to return only a subset of rows. Am I missing something?

davidt99 avatar Sep 26 '17 13:09 davidt99

Any update on this ticket please. thanks a lot. i'm new to this. but i was trying to make a path as required. and also has the ability to do where path like "/tmp/%" but i noticed it was getting this as is and not as a regex so i had to overcome this by joining file table. appreciate any advice.

anelshaer avatar Sep 25 '20 14:09 anelshaer