{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/30383999","id":30383999,"diff_hunk":"@@ -0,0 +1,115 @@\n+/*\n+ *  Copyright (c) 2015, Facebook, Inc.\n+ *  All rights reserved.\n+ *\n+ *  This source code is licensed under the BSD-style license found in the\n+ *  LICENSE file in the root directory of this source tree. An additional grant\n+ *  of patent rights can be found in the PATENTS file in the same directory.\n+ *\n+ */\n+\n+#include <map>\n+#include <string>\n+\n+#include <osquery/core.h>\n+#include <osquery/filesystem.h>\n+#include <osquery/config.h>\n+#include <osquery/logger.h>\n+\n+namespace pt = boost::property_tree;\n+namespace fs = boost::filesystem;\n+\n+namespace osquery {\n+namespace tables {\n+\n+\n+/**\n+ * @brief A simple ConfigParserPlugin for a \"packs\" dictionary key.\n+ *\n+ */\n+class QueryPackConfigParserPlugin : public ConfigParserPlugin {\n+ public:\n+  /// Request \"packs\" top level key.\n+  std::vector<std::string> keys() { return {\"packs\"}; }\n+\n+ private:\n+  /// Store the signatures and file_paths and compile the rules.\n+  Status update(const std::map<std::string, ConfigTree>& config);\n+};\n+\n+pt::ptree QueryPackSingleEntry(const pt::ptree pack_data) {\n+  std::string query = pack_data.get<std::string>(\"query\", \"\");\n+  int interval = std::stoi(pack_data.get<std::string>(\"interval\", \"0\"));\n+  std::string platform = pack_data.get<std::string>(\"platform\", \"\");\n+  std::string version = pack_data.get<std::string>(\"version\", \"\");\n+  std::string description = pack_data.get<std::string>(\"description\", \"\");\n+  std::string value = pack_data.get<std::string>(\"value\", \"\");\n+\n+  pt::ptree result;\n+  result.put(\"query\", query);\n+  result.put(\"interval\", interval);\n+  result.put(\"platform\", platform);\n+  result.put(\"version\", version);\n+  result.put(\"description\", description);\n+  result.put(\"value\", value);\n+\n+  return result;\n+}\n+\n+Status QueryPackConfigParserPlugin::update(const std::map<std::string, ConfigTree>& config) {\n+  Status status;\n+  const auto& pack_config = config.at(\"packs\");\n+  for(auto const &pack_element : pack_config) {\n+    // Iterate through all the packs to get the configuration\n+    auto pack_name = std::string(pack_element.first.data());\n+    auto pack_path = std::string(pack_element.second.data());\n+\n+    // Read each pack configuration in JSON\n+    pt::ptree pack_tree;\n+    status = osquery::parseJSON(pack_path, pack_tree);\n+\n+    if (!status.ok()) {\n+      LOG(ERROR) << \"Error parsing Pack JSON : \" << status.getCode() << \" - \" << status.getMessage();","path":"osquery/config/parsers/query_packs.cpp","position":72,"original_position":72,"commit_id":"aa27159bb80ed68835ee8c14308b61c199a6fbf2","original_commit_id":"aa27159bb80ed68835ee8c14308b61c199a6fbf2","user":{"login":"javuto","id":1271349,"avatar_url":"https://avatars.githubusercontent.com/u/1271349?v=3","gravatar_id":"","url":"https://api.github.com/users/javuto","html_url":"https://github.com/javuto","followers_url":"https://api.github.com/users/javuto/followers","following_url":"https://api.github.com/users/javuto/following{/other_user}","gists_url":"https://api.github.com/users/javuto/gists{/gist_id}","starred_url":"https://api.github.com/users/javuto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javuto/subscriptions","organizations_url":"https://api.github.com/users/javuto/orgs","repos_url":"https://api.github.com/users/javuto/repos","events_url":"https://api.github.com/users/javuto/events{/privacy}","received_events_url":"https://api.github.com/users/javuto/received_events","type":"User","site_admin":false},"body":"```WARNING``` should be fine","created_at":"2015-05-15T04:12:12Z","updated_at":"2015-05-15T04:12:12Z","html_url":"https://github.com/facebook/osquery/pull/1143#discussion_r30383999","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/1143","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/30383999"},"html":{"href":"https://github.com/facebook/osquery/pull/1143#discussion_r30383999"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1143"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1143","id":35398740,"html_url":"https://github.com/facebook/osquery/pull/1143","diff_url":"https://github.com/facebook/osquery/pull/1143.diff","patch_url":"https://github.com/facebook/osquery/pull/1143.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1143","number":1143,"state":"open","locked":false,"title":"Support to load query packs as scheduled queries","user":{"login":"javuto","id":1271349,"avatar_url":"https://avatars.githubusercontent.com/u/1271349?v=3","gravatar_id":"","url":"https://api.github.com/users/javuto","html_url":"https://github.com/javuto","followers_url":"https://api.github.com/users/javuto/followers","following_url":"https://api.github.com/users/javuto/following{/other_user}","gists_url":"https://api.github.com/users/javuto/gists{/gist_id}","starred_url":"https://api.github.com/users/javuto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javuto/subscriptions","organizations_url":"https://api.github.com/users/javuto/orgs","repos_url":"https://api.github.com/users/javuto/repos","events_url":"https://api.github.com/users/javuto/events{/privacy}","received_events_url":"https://api.github.com/users/javuto/received_events","type":"User","site_admin":false},"body":"This code allows loading query packs from the configuration, as the element \"packs\" and pointing to a different file per pack.","created_at":"2015-05-14T07:00:01Z","updated_at":"2015-05-15T04:12:12Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b1f20c2f7bf1f6ec8a1344d58a2d24e5ada585fb","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/1143/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/1143/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1143/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/aa27159bb80ed68835ee8c14308b61c199a6fbf2","head":{"label":"javuto:pack_config_changes","ref":"pack_config_changes","sha":"aa27159bb80ed68835ee8c14308b61c199a6fbf2","user":{"login":"javuto","id":1271349,"avatar_url":"https://avatars.githubusercontent.com/u/1271349?v=3","gravatar_id":"","url":"https://api.github.com/users/javuto","html_url":"https://github.com/javuto","followers_url":"https://api.github.com/users/javuto/followers","following_url":"https://api.github.com/users/javuto/following{/other_user}","gists_url":"https://api.github.com/users/javuto/gists{/gist_id}","starred_url":"https://api.github.com/users/javuto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javuto/subscriptions","organizations_url":"https://api.github.com/users/javuto/orgs","repos_url":"https://api.github.com/users/javuto/repos","events_url":"https://api.github.com/users/javuto/events{/privacy}","received_events_url":"https://api.github.com/users/javuto/received_events","type":"User","site_admin":false},"repo":{"id":34071717,"name":"osquery","full_name":"javuto/osquery","owner":{"login":"javuto","id":1271349,"avatar_url":"https://avatars.githubusercontent.com/u/1271349?v=3","gravatar_id":"","url":"https://api.github.com/users/javuto","html_url":"https://github.com/javuto","followers_url":"https://api.github.com/users/javuto/followers","following_url":"https://api.github.com/users/javuto/following{/other_user}","gists_url":"https://api.github.com/users/javuto/gists{/gist_id}","starred_url":"https://api.github.com/users/javuto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javuto/subscriptions","organizations_url":"https://api.github.com/users/javuto/orgs","repos_url":"https://api.github.com/users/javuto/repos","events_url":"https://api.github.com/users/javuto/events{/privacy}","received_events_url":"https://api.github.com/users/javuto/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/javuto/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/javuto/osquery","forks_url":"https://api.github.com/repos/javuto/osquery/forks","keys_url":"https://api.github.com/repos/javuto/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/javuto/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/javuto/osquery/teams","hooks_url":"https://api.github.com/repos/javuto/osquery/hooks","issue_events_url":"https://api.github.com/repos/javuto/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/javuto/osquery/events","assignees_url":"https://api.github.com/repos/javuto/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/javuto/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/javuto/osquery/tags","blobs_url":"https://api.github.com/repos/javuto/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/javuto/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/javuto/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/javuto/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/javuto/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/javuto/osquery/languages","stargazers_url":"https://api.github.com/repos/javuto/osquery/stargazers","contributors_url":"https://api.github.com/repos/javuto/osquery/contributors","subscribers_url":"https://api.github.com/repos/javuto/osquery/subscribers","subscription_url":"https://api.github.com/repos/javuto/osquery/subscription","commits_url":"https://api.github.com/repos/javuto/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/javuto/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/javuto/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/javuto/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/javuto/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/javuto/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/javuto/osquery/merges","archive_url":"https://api.github.com/repos/javuto/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/javuto/osquery/downloads","issues_url":"https://api.github.com/repos/javuto/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/javuto/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/javuto/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/javuto/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/javuto/osquery/labels{/name}","releases_url":"https://api.github.com/repos/javuto/osquery/releases{/id}","created_at":"2015-04-16T17:59:16Z","updated_at":"2015-05-08T19:21:42Z","pushed_at":"2015-05-15T00:20:05Z","git_url":"git://github.com/javuto/osquery.git","ssh_url":"git@github.com:javuto/osquery.git","clone_url":"https://github.com/javuto/osquery.git","svn_url":"https://github.com/javuto/osquery","homepage":"https://osquery.io","size":5120,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"4d9d264600685d75b8b7eba9ab91d58c34d977ba","user":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","created_at":"2014-07-29T20:27:33Z","updated_at":"2015-05-14T15:38:31Z","pushed_at":"2015-05-15T02:36:06Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":17059,"stargazers_count":4199,"watchers_count":4199,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":331,"mirror_url":null,"open_issues_count":35,"forks":331,"open_issues":35,"watchers":4199,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1143"},"html":{"href":"https://github.com/facebook/osquery/pull/1143"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/1143"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/1143/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1143/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1143/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/aa27159bb80ed68835ee8c14308b61c199a6fbf2"}}}}