macadmins / macadmins/osquery-extension
Show tags on `crowdstrike_falcon` table (or on another new related table)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 132
- Forks
- 41
- Avg merge
- 1d 48m
- Merged PRs (30d)
- 3
Description
This would spit out the output of `falconctl -g --tags` on Linux, either comma-separated for multiple tags or maybe a new table with rows for each tag rather than forcing `crowdstrike_falcon` to have multiple rows for this one attribute.
Posting here because this is probably a better spot to add this work vs. the `falconctl_options` table that Fleet maintains (see https://github.com/fleetdm/fleet/issues/32239), given that that table uses the old Kolide-style API that exposes some rather thorny implementation details ("is not set" being returned as column values). So instead of breaking BC with that table on our side, maybe we can add compat here and point folks to the new table here for a cleaner querying experience.
If folks like the idea/agree on a design one way or the other (@jc0b?), I can probably do the impl work.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the existing `crowdstrike_falcon` table and the `falconctl -g --tags` output described in the issue. Compare that with the `falconctl_options` table and Fleet issue #32239 before deciding whether tags belong as columns or in a related table; done means the design is agreed and tags are queryable without the old table's compatibility concerns.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100