Revise discovery queries for Python software inventory to be compatible with earlier versions of osquery (#27130)

This commit is contained in:
Ian Littman
2025-03-13 17:32:06 -06:00
committed by GitHub
parent afded30966
commit 1537eb710f
2 changed files with 20 additions and 4 deletions
+10 -2
View File
@@ -741,7 +741,11 @@ WITH app_paths AS (
- Discovery query:
```sql
SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') < 0
SELECT 1 FROM (
SELECT
CAST(SUBSTR(version, 1, INSTR(version, '.') - 1) AS INTEGER) major,
CAST(SUBSTR(version, INSTR(version, '.') + 1, INSTR(SUBSTR(version, INSTR(version, '.') + 1), '.') - 1) AS INTEGER) minor from osquery_info
) AS version_parts WHERE major < 5 OR (major = 5 AND minor < 16)
```
- Query:
@@ -765,7 +769,11 @@ SELECT
- Discovery query:
```sql
SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') >= 0
SELECT 1 FROM (
SELECT
CAST(substr(version, 1, instr(version, '.') - 1) AS INTEGER) major,
CAST(substr(version, instr(version, '.') + 1, instr(substr(version, instr(version, '.') + 1), '.') - 1) AS INTEGER) minor from osquery_info
) AS version_parts WHERE major > 5 OR (major = 5 AND minor >= 16)
```
- Query: