osquery: the host identifier is not a selected column

The daemon stamps the sender

A scheduled result line carries a host identifier outside the columns object. That string is how this daemon was configured to name itself, often a uuid. It is the identity of the sender of the line. It is not one of the cells the statement selected.

If the identifier is missing from the line you saved, write “host identifier not on this line.” Do not promote a column into that slot because the column looks like a machine name.

A hostname column is query output

If the statement selected hostname, computer_name, or a similar field, that cell is whatever the table returned inside the operating system. A lab image can report localhost, a short name, or a name that no longer matches DNS. That cell can be useful. It is still a selected value, not the stamp on the envelope.

Two lines with the same hostname cell and different host identifiers are two senders. Two lines with one identifier and different hostname cells are one sender whose query returned two names.

What to file

File the host identifier, then any hostname column with the column’s name. Say which one is the stamp and which one is the cell. A sentence that says “the host” has to pick one of them.

Worked case: localhost in the cell, a uuid on the line

A disk_free line from the lab fleet has host identifier b7e1c0aa-4400-4a10-9c10-lab000000004. The columns include hostname localhost. A draft files the row under localhost and drops the uuid, then later cannot tell which machine produced it.

The note keeps b7e1c0aa-4400-4a10-9c10-lab000000004 as the sender. hostname localhost is quoted as the cell the statement returned. The finding is not retitled to localhost.

host identifier: b7e1c0aa-4400-4a10-9c10-lab000000004
columns.hostname: localhost
write: sender is the identifier
cell: hostname returned localhost
not: file the row under localhost