macadmins / macadmins/osquery-extension

Show tags on `crowdstrike_falcon` table (or on another new related table)

Open
#74 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
132
Forks
41
Avg merge
1d 48m
Merged PRs (30d)
3

Description

This would spit out the output of `falconctl -g --tags` on Linux, either comma-separated for multiple tags or maybe a new table with rows for each tag rather than forcing `crowdstrike_falcon` to have multiple rows for this one attribute.

Posting here because this is probably a better spot to add this work vs. the `falconctl_options` table that Fleet maintains (see https://github.com/fleetdm/fleet/issues/32239), given that that table uses the old Kolide-style API that exposes some rather thorny implementation details ("is not set" being returned as column values). So instead of breaking BC with that table on our side, maybe we can add compat here and point folks to the new table here for a cleaner querying experience.

If folks like the idea/agree on a design one way or the other (@jc0b?), I can probably do the impl work.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the existing `crowdstrike_falcon` table and the `falconctl -g --tags` output described in the issue. Compare that with the `falconctl_options` table and Fleet issue #32239 before deciding whether tags belong as columns or in a related table; done means the design is agreed and tags are queryable without the old table's compatibility concerns.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.