Project

General

Profile

User story #15155

Add methods to define variables from osquery queries

Added by Alexis MOUSSET 4 months ago. Updated 2 months ago.

Status:
Released
Priority:
N/A
Category:
Generic methods
Target version:
Suggestion strength:
User visibility:
Effort required:

Description

  • variable_string_from_osquery
  • variable_dict_from_osquery

Related issues

Related to ncf - Bug #15658: osquery documentation enhancementPending releaseActions

Associated revisions

Revision 69eb0a92 (diff)
Added by Alexis MOUSSET 4 months ago

Fixes #15155: Add methods to define variables from osquery queries

History

#1

Updated by Alexis MOUSSET 4 months ago

  • Status changed from New to In progress
#2

Updated by Alexis MOUSSET 4 months ago

  • Subject changed from Add methods to define variables for osquery queries to Add methods to define variables from osquery queries
  • Status changed from In progress to New
#3

Updated by Alexis MOUSSET 4 months ago

  • Status changed from New to Pending technical review
  • Assignee changed from Alexis MOUSSET to Benoît PECCATTE
  • Pull Request set to https://github.com/Normation/ncf/pull/997
#4

Updated by Vincent MEMBRÉ 4 months ago

  • Target version changed from 5.0.12 to 5.0.13
#6

Updated by Rudder Quality Assistant 4 months ago

  • Assignee changed from Benoît PECCATTE to Alexis MOUSSET
#7

Updated by Alexis MOUSSET 4 months ago

  • Status changed from Pending technical review to Pending release
#8

Updated by François ARMAND 2 months ago

Test: some caveat that should be documented:

- osquery needs to be installed. It's documented in "setup", but perhaps it could get a bit of emphasis:

This method requires the presence of <a href="https://osquery.io/">osquery</a> on the target nodes.
This method requires the presence of <a href="https://osquery.io/">osquery</a> on the target nodes.
It won't install it automatically. Check the correct way of doing so for your OS.

- you can't use "osquery" variable prefix, which is extremely suprising. If you do so, you get:

   error: Remote bundle variable injection detected!
   error: Variable identifier 'osquery.foo' is not legal
   error: Promise belongs to bundle 'variable_dict_from_osquery' in file '/var/rudder/ncf/common/30_generic_methods/variable_dict_from_osquery.cf' near line 81

I'm opening a ticket for these two enhancements.

#9

Updated by François ARMAND 2 months ago

  • Related to Bug #15658: osquery documentation enhancement added
#11

Updated by Vincent MEMBRÉ 2 months ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 5.0.13 which was released today.

Also available in: Atom PDF