empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 00:45:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Return correct OS details for Windows Server 2019 (#17760)

Browse Source
This commit is contained in:
Dante Catalfamo 2024-03-25 10:06:36 -04:00 committed by GitHub
parent a0e3407f21
commit ee14a26df4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 29 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changes/17562-windows-server-2019-os-details Normal file
View File

@ -0,0 +1 @@
- Fixed a bug where OS version information would not get detected on Windows Server 2019

37
server/service/osquery_utils/queries.go
View File

@ -172,14 +172,24 @@ var hostDetailQueries = map[string]DetailQuery{
},
},
"os_version_windows": {
// display_version is not available in some versions of
// Windows (Server 2019). By including it using a JOIN it can
// return no rows and the query will still succeed
Query: `
SELECT os.name, r.data as display_version, k.version
WITH display_version_table AS (
SELECT data as display_version
FROM registry
WHERE path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion'
)
SELECT
os.name,
COALESCE(d.display_version, '') AS display_version,
k.version
FROM
registry r,
os_version os,
kernel_info k
WHERE r.path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion'
`,
LEFT JOIN
display_version_table d`,
Platforms: []string{"windows"},
IngestFunc: func(ctx context.Context, logger log.Logger, host *fleet.Host, rows []map[string]string) error {
if len(rows) != 1 {
@ -531,20 +541,29 @@ var extraDetailQueries = map[string]DetailQuery{
// This query is used to populate the `operating_systems` and `host_operating_system`
// tables. Separately, the `hosts` table is populated via the `os_version` and
// `os_version_windows` detail queries above.
//
// DisplayVersion doesn't exist on all versions of Windows (Server 2019).
// To prevent the query from failing in those cases, we join
// the values in when they exist, alternatively the column is
// just empty.
Query: `
WITH display_version_table AS (
SELECT data as display_version
FROM registry
WHERE path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion'
)
SELECT
os.name,
os.platform,
os.arch,
k.version as kernel_version,
os.version,
r.data as display_version
COALESCE(d.display_version, '') AS display_version
FROM
os_version os,
kernel_info k,
registry r
WHERE
r.path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion'`,
kernel_info k
LEFT JOIN
display_version_table d`,
Platforms: []string{"windows"},
DirectIngestFunc: directIngestOSWindows,
},