Order columns in hostname flatten output (#2939)

Velocidex · Sep 10, 2023 · 82f2cad · 82f2cad
1 parent 89da84b
commit 82f2cad
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/artifacts/definitions/Generic/System/HostsFile.yaml b/artifacts/definitions/Generic/System/HostsFile.yaml
@@ -76,14 +76,16 @@ sources:
   - name: Hosts
     query: |
       SELECT OSPath, Address,
-        filter(list= (Hostname, ) + Aliases, regex=HostnameRegex) AS Hostname,
+        (Hostname, ) + Aliases AS Hostname,
         Comment
       FROM HostsFiles
-      WHERE Hostname AND Address =~ AddressRegex
+      WHERE Hostname =~ HostnameRegex
+        AND Address =~ AddressRegex
 
   - name: HostsFlattened
     query: |
-      SELECT * FROM flatten(query={
+      SELECT OSPath, Address, Hostname, Comment
+      FROM flatten(query={
         SELECT OSPath, Address, (Hostname, ) + Aliases AS Hostname, Comment
         FROM HostsFiles
       })

diff --git a/artifacts/testdata/server/testcases/hostsfile.out.yaml b/artifacts/testdata/server/testcases/hostsfile.out.yaml
@@ -55,7 +55,8 @@ SELECT * FROM Artifact.Windows.System.HostsFile( HostsFile=srcDir + '/artifacts/
  {
   "Address": "127.0.3.4",
   "Hostname": [
-   "second.com"
+   "second.com",
+   "standardcomment2.com"
   ],
   "Comment": "testing standard comment"
  }