Show tags on `crowdstrike_falcon` table (or on another new related table)
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 32/100
Research direction
Start by reviewing the existing crowdstrike_falcon table and the falconctl -g --tags output described in the issue. Compare that with the falconctl_options table and Fleet issue #32239 before deciding whether tags belong as columns or in a related table; done means the design is agreed and tags are queryable without the old table's compatibility concerns.
Written by the indexing model from the issue text.
Description
This would spit out the output of falconctl -g --tags on Linux, either comma-separated for multiple tags or maybe a new table with rows for each tag rather than forcing crowdstrike_falcon to have multiple rows for this one attribute.
Posting here because this is probably a better spot to add this work vs. the falconctl_options table that Fleet maintains (see https://github.com/fleetdm/fleet/issues/32239), given that that table uses the old Kolide-style API that exposes some rather thorny implementation details ("is not set" being returned as column values). So instead of breaking BC with that table on our side, maybe we can add compat here and point folks to the new table here for a cleaner querying experience.
If folks like the idea/agree on a design one way or the other (@jc0b?), I can probably do the impl work.
- Dominant language
- Go
- Stars
- 134
- Forks
- 42
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from macadmins/osquery-extension
-
osquery-go bump, then Terraform (providers) and JavaScript (project/package mgmt) lockfile tablesOpen
Difficulty 5/5 Over a week Newbie friendliness 25/100
macadmins/osquery-extension#134 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
macadmins/osquery-extension#125 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
macadmins/osquery-extension#122 · 5 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
macadmins/osquery-extension#61 · 3 comments ·
All issues in macadmins/osquery-extension
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
CycloneDX/cyclonedx-go#304 ·
-
[Bug]: snowflake_share fails to read a share attached to a listing with target accounts ('TARGETED ACCOUNTS' in the "to" column)Possibly taken @akhil9tiet claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
snowflakedb/terraform-provider-snowflake#5366 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
txn2/mcp-data-platform#2493 ·
Maintainers usually reply within 1 day
-
fix(doctor): format MongoDB URI and UNIX socket addresses correctly in doctor diagnostic outputOpenbug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
oscarbol09/branchbase#178 ·
Maintainers usually reply within 4 days