Add initial test of ntfs ads table

ee/tables/ntfs_ads_zone_id/zone_identifier.go

@@ -0,0 +1,73 @@
+//go:build windows
+// +build windows
+
+package ntfs_ads_zone_id
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"log/slog"
+	"path/filepath"
+	"strings"
+
+	"github.com/kolide/launcher/ee/allowedcmd"
+	"github.com/kolide/launcher/ee/dataflatten"
+	"github.com/kolide/launcher/ee/tables/dataflattentable"
+	"github.com/kolide/launcher/ee/tables/tablehelpers"
+	"github.com/osquery/osquery-go/plugin/table"
+)
+
+type Table struct {
+	slogger *slog.Logger
+}
+
+func TablePlugin(slogger *slog.Logger) *table.Plugin {
+	columns := dataflattentable.Columns(
+		table.TextColumn("path"),
+	)
+
+	t := &Table{
+		slogger: slogger.With("table", "kolide_ntfs_ads_zone_id"),
+	}
+
+	return table.NewPlugin("kolide_ntfs_ads_zone_id", columns, t.generate)
+}
+
+func (t *Table) generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
+	var results []map[string]string
+
+	paths := tablehelpers.GetConstraints(queryContext, "path")
+	if len(paths) < 1 {
+		return nil, fmt.Errorf("kolide_ntfs_ads_zone_id requires at least one path to be specified")
+	}
+
+	for _, path := range paths {
+		for _, dataQuery := range tablehelpers.GetConstraints(queryContext, "query", tablehelpers.WithDefaults("*")) {
+			var output bytes.Buffer
+			if err := tablehelpers.Run(ctx, t.slogger, 30, allowedcmd.Powershell, []string{"Get-Content", "-Path", filepath.Clean(path), "-Stream", "Zone.Identifier", "-ErrorAction", "Ignore"}, &output, &output); err != nil {
+				t.slogger.Log(ctx, slog.LevelInfo, "failure running powershell get-content command", "err", err, "path", path)
+				continue
+			}
+
+			flattenOpts := []dataflatten.FlattenOpts{
+				dataflatten.WithSlogger(t.slogger),
+				dataflatten.WithQuery(strings.Split(dataQuery, "/")),
+			}
+
+			flattened, err := dataflatten.Ini(output.Bytes(), flattenOpts...)
+			if err != nil {
+				t.slogger.Log(ctx, slog.LevelInfo, "failure flattening output", "err", err)
+				continue
+			}
+
+			rowData := map[string]string{
+				"path": path,
+			}
+
+			results = append(results, dataflattentable.ToMap(flattened, dataQuery, rowData)...)
+		}
+	}
+
+	return results, nil
+}

pkg/osquery/table/platform_tables_windows.go

@@ -10,6 +10,7 @@ import (
 	"github.com/kolide/launcher/ee/tables/dataflattentable"
 	"github.com/kolide/launcher/ee/tables/dsim_default_associations"
 	"github.com/kolide/launcher/ee/tables/execparsers/dsregcmd"
+	"github.com/kolide/launcher/ee/tables/ntfs_ads_zone_id"
 	"github.com/kolide/launcher/ee/tables/secedit"
 	"github.com/kolide/launcher/ee/tables/wifi_networks"
 	"github.com/kolide/launcher/ee/tables/windowsupdatetable"
@@ -21,6 +22,7 @@ func platformSpecificTables(slogger *slog.Logger, currentOsquerydBinaryPath stri
 	return []osquery.OsqueryPlugin{
 		ProgramIcons(),
 		dsim_default_associations.TablePlugin(slogger),
+		ntfs_ads_zone_id.TablePlugin(slogger),
 		secedit.TablePlugin(slogger),
 		wifi_networks.TablePlugin(slogger),
 		windowsupdatetable.TablePlugin(windowsupdatetable.UpdatesTable, slogger),