osquery-site icon indicating copy to clipboard operation
osquery-site copied to clipboard

Table schema is missing "architecture support"

Open mike-myers-tob opened this issue 2 years ago • 3 comments

Several tables are architecture-specific now, existing or producing results only in x86 builds of osquery (and at a future date, probably ones specific to ARM).

The schema, and the website's view of it, doesn't expose this information for the user, as several people have noted.

mike-myers-tob avatar Jun 15 '22 19:06 mike-myers-tob

I think this belongs in the osquery repo -- that's where the schema is generated. We'll need to update the website to consume it, once it exists though

directionless avatar Jun 20 '22 18:06 directionless

An (interim) attempt at addressing this is here: https://github.com/osquery/osquery/pull/7650

It's just language in the description of each table.

zhumo avatar Jun 24 '22 14:06 zhumo

I don't think description text is enough. I think we need to think about how to surface supported architectures, and not just platforms.

I can't quite decide if it's simple, of if we need to surface things as the intersection between arch and platform

directionless avatar Jun 24 '22 17:06 directionless