dataflattentable

Documentation

Index

• func AllTablePlugins(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin
• func Columns(additional ...table.ColumnDefinition) []table.ColumnDefinition
• func TablePlugin(client *osquery.ExtensionManagerClient, logger log.Logger, ...) *table.Plugin
• func TablePluginExec(client *osquery.ExtensionManagerClient, logger log.Logger, tableName string, ...) *table.Plugin
• func ToMap(rows []dataflatten.Row, query string, rowData map[string]string) []map[string]string
• type DataSourceType
• type ExecTableOpt
  • func WithBinDirs(binDirs ...string) ExecTableOpt
  • func WithKVSeparator(separator string) ExecTableOpt
• type Table

Functions

func AllTablePlugins

func AllTablePlugins(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin

AllTablePlugins is a helper to return all the expected flattening tables.

func Columns

func Columns(additional ...table.ColumnDefinition) []table.ColumnDefinition

Columns returns the standard data flatten columns, plus whatever ones have been provided as additional. This is syntantic sugar for dataflatten based tables.

func TablePlugin

func TablePlugin(client *osquery.ExtensionManagerClient, logger log.Logger, dataSourceType DataSourceType) *table.Plugin

func TablePluginExec

func TablePluginExec(client *osquery.ExtensionManagerClient, logger log.Logger, tableName string, dataSourceType DataSourceType, execArgs []string, opts ...ExecTableOpt) *table.Plugin

func ToMap

func ToMap(rows []dataflatten.Row, query string, rowData map[string]string) []map[string]string

ToMap is a helper function to convert Flatten output directly for consumption by osquery tables.

Types

type DataSourceType

type DataSourceType int

const (
	PlistType DataSourceType = iota + 1
	JsonType
	ExecType
	XmlType
	IniType
	KeyValueType
)

type ExecTableOpt

type ExecTableOpt func(*Table)

func WithBinDirs

func WithBinDirs(binDirs ...string) ExecTableOpt

func WithKVSeparator

func WithKVSeparator(separator string) ExecTableOpt

WithKVSeparator sets the delimiter between key and value. It replaces the default ":" in dataflattentable.Table

type Table

type Table struct {
	// contains filtered or unexported fields
}