tablehelpers

Documentation

Index

• func Exec(ctx context.Context, logger log.Logger, timeoutSeconds int, ...) ([]byte, error)
• func ExecOsqueryLaunchctl(ctx context.Context, logger log.Logger, timeoutSeconds int, username string, ...) ([]byte, error)
• func ExecOsqueryLaunchctlParsed(ctx context.Context, logger log.Logger, timeoutSeconds int, username string, ...) ([]map[string]string, error)
• func GetConstraints(queryContext table.QueryContext, columnName string, opts ...GetConstraintOpts) []string
• func MockQueryContext(constraints map[string][]string) table.QueryContext
• func StanzaSplitter(data []byte, atEOF bool) (int, []byte, error)
• type GetConstraintOpts
  • func WithAllowedCharacters(allowed string) GetConstraintOpts
  • func WithAllowedValues(allowed []string) GetConstraintOpts
  • func WithDefaults(defaults ...string) GetConstraintOpts
  • func WithLogger(logger log.Logger) GetConstraintOpts
• type Matcher
• type OutputParser
  • func NewParser(logger log.Logger, matchers []Matcher) *OutputParser
  • func (p *OutputParser) Parse(input *bytes.Buffer) map[string]string
  • func (p *OutputParser) ParseMultiple(input *bytes.Buffer) []map[string]string

Functions

func Exec

func Exec(ctx context.Context, logger log.Logger, timeoutSeconds int, possibleBins []string, args []string) ([]byte, error)

Exec is a wrapper over exec.CommandContext. It does a couple of additional things to help with table usage:

1. It enforces a timeout.
2. Second, it accepts an array of possible binaries locations, and if something is not found, it will go down the list.
3. It moves the stderr into the return error, if needed.

This is not suitable for high performance work -- it allocates new buffers each time.

func ExecOsqueryLaunchctl

func ExecOsqueryLaunchctl(ctx context.Context, logger log.Logger, timeoutSeconds int, username string, osqueryPath string, query string) ([]byte, error)

ExecOsqueryLaunchctl runs osquery under launchctl, in a user context.

func ExecOsqueryLaunchctlParsed

func ExecOsqueryLaunchctlParsed(ctx context.Context, logger log.Logger, timeoutSeconds int, username string, osqueryPath string, query string) ([]map[string]string, error)

func GetConstraints

func GetConstraints(queryContext table.QueryContext, columnName string, opts ...GetConstraintOpts) []string

GetConstraints returns a []string of the constraint expressions on a column. It's meant for the common, simple, usecase of iterating over them.

func MockQueryContext

func MockQueryContext(constraints map[string][]string) table.QueryContext

func StanzaSplitter

func StanzaSplitter(data []byte, atEOF bool) (int, []byte, error)

StanzaSplitter implements the bufio.SplitFunc type, when used as the Split function for a bufio.Scanner, it will return chunks of bytes separated by an empty newline, e.g. \n\n or \r\n\r\n.

Types

type GetConstraintOpts

type GetConstraintOpts func(*constraintOptions)

func WithAllowedCharacters

func WithAllowedCharacters(allowed string) GetConstraintOpts

func WithAllowedValues

func WithAllowedValues(allowed []string) GetConstraintOpts

func WithDefaults

func WithDefaults(defaults ...string) GetConstraintOpts

WithDefaults sets the defaults to use if no constraints were specified. Note that this does not apply if there were constraints, which were invalidated.

func WithLogger

func WithLogger(logger log.Logger) GetConstraintOpts

WithLogger sets the logger to use

type Matcher

type Matcher struct {
	Match   func(string) bool
	KeyFunc func(string) (string, error)
	ValFunc func(string) (string, error)
}

type OutputParser

type OutputParser struct {
	// contains filtered or unexported fields
}

func NewParser

func NewParser(logger log.Logger, matchers []Matcher) *OutputParser

func (*OutputParser) Parse

func (p *OutputParser) Parse(input *bytes.Buffer) map[string]string

Parse looks at a chunk of input. It is assumed that the input contains information to fill in a single result. Do not provide input that contains data for multiple results.

func (*OutputParser) ParseMultiple

func (p *OutputParser) ParseMultiple(input *bytes.Buffer) []map[string]string

Parse looks at command output, line by line. It uses the defined Matchers to set any appropriate values