def _osquery_cmd(table, attrs=None, where=None, format='json'):
 ret = {'result': True}
 if attrs:
  if isinstance(attrs, list):
   valid_attrs = _table_attrs(table)
   if valid_attrs:
    for a in attrs:
     if (a not in valid_attrs):
      ret['result'] = False
      ret['comment'] = '{0} is not a valid attribute for table {1}'.format(a, table)
      return ret
    _attrs = ','.join(attrs)
   else:
    ret['result'] = False
    ret['comment'] = 'Invalid table {0}.'.format(table)
    return ret
  else:
   ret['comment'] = 'attrs must be specified as a list.'
   ret['result'] = False
   return ret
 else:
  _attrs = '*'
 sql = 'select {0} from {1}'.format(_attrs, table)
 if where:
  sql = '{0} where {1}'.format(sql, where)
 sql = '{0};'.format(sql)
 res = _osquery(sql)
 if res['result']:
  ret['data'] = res['data']
 else:
  ret['comment'] = res['error']
 return ret

def _osquery_cmd ( table , attrs = None , where = None , format = 'json' ) : ret = { 'result' : True } if attrs : if isinstance ( attrs , list ) : valid_attrs = _table_attrs ( table ) if valid_attrs : for a in attrs : if ( a not in valid_attrs ) : ret [ 'result' ] = False ret [ 'comment' ] = '{0} is not a valid attribute for table {1}' . format ( a , table ) return ret _attrs = ',' . join ( attrs ) else : ret [ 'result' ] = False ret [ 'comment' ] = 'Invalid table {0}.' . format ( table ) return ret else : ret [ 'comment' ] = 'attrs must be specified as a list.' ret [ 'result' ] = False return ret else : _attrs = '*' sql = 'select {0} from {1}' . format ( _attrs , table ) if where : sql = '{0} where {1}' . format ( sql , where ) sql = '{0};' . format ( sql ) res = _osquery ( sql ) if res [ 'result' ] : ret [ 'data' ] = res [ 'data' ] else : ret [ 'comment' ] = res [ 'error' ] return ret
helper function to run osquery queries .