table

type ColumnDefinition ¶

type ColumnDefinition struct {
	Name string
	Type ColumnType
}

ColumnDefinition defines the relevant information for a column in a table plugin. Both values are mandatory. Prefer using the *Column helpers to create ColumnDefinition structs.

func BigIntColumn(name string) ColumnDefinition

func DoubleColumn(name string) ColumnDefinition

func IntegerColumn(name string) ColumnDefinition

func TextColumn(name string) ColumnDefinition

type ColumnType ¶

type ColumnType string

ColumnType is a strongly typed representation of the data type string for a column definition. The named constants should be used.

type Constraint ¶

type Constraint struct {
	Operator   Operator
	Expression string
}

Constraint contains both an operator and an expression that are applied as constraints in the query.

type ConstraintList ¶

type ConstraintList struct {
	Affinity    ColumnType
	Constraints []Constraint
}

ConstraintList contains the details of the constraints for the given column.

type GenerateFunc ¶

type GenerateFunc func(ctx context.Context, queryContext QueryContext) ([]map[string]string, error)

Generate returns the rows generated by the table. The ctx argument should be checked for cancellation if the generation performs a substantial amount of work. The queryContext argument provides the deserialized JSON query context from osquery.

type Operator ¶

type Operator int

Operator is an enum of the osquery operators.

type Plugin ¶

type Plugin struct {
	// contains filtered or unexported fields
}

func NewPlugin(name string, columns []ColumnDefinition, gen GenerateFunc) *Plugin

func (t *Plugin) Call(ctx context.Context, request osquery.ExtensionPluginRequest) osquery.ExtensionResponse

func (t *Plugin) Name() string

func (t *Plugin) Ping() osquery.ExtensionStatus

func (t *Plugin) RegistryName() string

func (t *Plugin) Routes() osquery.ExtensionPluginResponse

func (t *Plugin) Shutdown()

type QueryContext ¶

type QueryContext struct {
	// Constraints is a map from column name to the details of the
	// constraints on that column.
	Constraints map[string]ConstraintList
}

QueryContext contains the constraints from the WHERE clause of the query, that can optionally be used to optimize the table generation. Note that the osquery SQLite engine will perform the filtering with these constraints, so it is not mandatory that they be used in table generation.