empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Allow users to customize detail queries for troubleshooting purposes (#6150)

Browse Source 
* Allow users to customize detail queries for troubleshooting purposes

* Address review comments
This commit is contained in:
Tomas Touceda 2022-06-09 10:33:49 -03:00 committed by GitHub
parent a6cf9b3d8d
commit fc215610a4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changes/issue-6073-customize-queries Normal file
View File

@ -0,0 +1 @@
* Allow users to customize detail queries for debugging purposes

15
server/service/osquery_utils/queries.go
View File

@ -4,6 +4,7 @@ import (
"context"
"fmt"
"net"
"os"
"strconv"
"strings"
"time"
@ -866,5 +867,19 @@ func GetDetailQueries(ac *fleet.AppConfig, fleetConfig config.FleetConfig) map[s
generatedMap["scheduled_query_stats"] = scheduledQueryStats
}
for _, env := range os.Environ() {
prefix := "FLEET_DANGEROUS_REPLACE_"
if !strings.HasPrefix(env, prefix) {
continue
}
if i := strings.Index(env, "="); i >= 0 {
queryName := strings.ToLower(strings.TrimPrefix(env[:i], prefix))
newQuery := env[i+1:]
query := generatedMap[queryName]
query.Query = newQuery
generatedMap[queryName] = query
}
}
return generatedMap
}

14
server/service/osquery_utils/queries_test.go
View File

@ -4,6 +4,7 @@ import (
"context"
"encoding/json"
"errors"
"os"
"sort"
"testing"
"time"
@ -441,3 +442,16 @@ func TestDirectIngestChromeProfiles(t *testing.T) {
require.NoError(t, err)
require.True(t, ds.ReplaceHostDeviceMappingFuncInvoked)
}
func TestDangerousReplaceQuery(t *testing.T) {
queries := GetDetailQueries(&fleet.AppConfig{HostSettings: fleet.HostSettings{EnableHostUsers: true}}, config.FleetConfig{})
originalQuery := queries["users"].Query
require.NoError(t, os.Setenv("FLEET_DANGEROUS_REPLACE_USERS", "select * from blah"))
queries = GetDetailQueries(&fleet.AppConfig{HostSettings: fleet.HostSettings{EnableHostUsers: true}}, config.FleetConfig{})
assert.NotEqual(t, originalQuery, queries["users"].Query)
require.NoError(t, os.Unsetenv("FLEET_DANGEROUS_REPLACE_USERS"))
queries = GetDetailQueries(&fleet.AppConfig{HostSettings: fleet.HostSettings{EnableHostUsers: true}}, config.FleetConfig{})
assert.Equal(t, originalQuery, queries["users"].Query)
}