Skip to content

Commit

Permalink
skip non-kolide packs in initial runner (#396)
Browse files Browse the repository at this point in the history
adds a continue in our initial runner code that will skip running queries in packs whose names contain _kolide_
  • Loading branch information
NickTitle authored Jan 4, 2019
1 parent 1f63f4d commit 1005e46
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion pkg/osquery/extension.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"encoding/binary"
"encoding/json"
"fmt"
"strings"
"sync"
"time"

Expand Down Expand Up @@ -844,9 +845,14 @@ func (i *initialRunner) Execute(configBlob string, writeFn func(ctx context.Cont

var allQueries []string
for packName, pack := range config.Packs {
// only run queries from kolide packs
if !strings.Contains(packName, "_kolide_") {
continue
}

for query, content := range pack.Queries {
// only run differential queries
if content.Snapshot != nil && *content.Snapshot {
// only deal with differential pack queries
continue
}
queryName := fmt.Sprintf("pack:%s:%s", packName, query)
Expand Down

0 comments on commit 1005e46

Please sign in to comment.