From 9f7383b9ffb92411a8531b431a266f5b4209d0d6 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Wed, 24 May 2023 14:28:20 -0300 Subject: [PATCH] Filter out `"null"` string in `installed_path` from osquery (#11931) --- server/service/osquery_utils/queries.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index 2af9617123..19db61bf75 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -1172,7 +1172,10 @@ func directIngestSoftware(ctx context.Context, logger log.Logger, host *fleet.Ho software = append(software, s) installedPath := strings.TrimSpace(row["installed_path"]) - if installedPath != "" { + if installedPath != "" && + // NOTE: osquery is sometimes incorrectly returning the value "null" for some install paths. + // Thus, we explicitly ignore such value here. + strings.ToLower(installedPath) != "null" { key := fmt.Sprintf("%s%s%s", installedPath, fleet.SoftwareFieldSeparator, s.ToUniqueStr()) sPaths[key] = struct{}{} }