[Osquerybeat] Add filtering functionality for osquery extension (#47396)

* osquerybeat filters

* notice update

* changelog fragment

* PR Feedback

* remove newly added dependency

* remove dependency

* fix dependency

* PR feedback, reduce complexity

* fix tests

* linting and pr feedback

Author: brian-mckinney

changelog/fragments/1761768958-osquery-extension-filters.yaml

@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: enhancement
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary: Add record filtering/scoping support to the osquery extension
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: osquerybeat
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+# pr: https://github.com/owner/repo/1234
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234

x-pack/osquerybeat/ext/osquery-extension/pkg/filters/cast.go

@@ -0,0 +1,96 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package filters
+
+import (
+	"reflect"
+	"strconv"
+)
+
+// resolveValue resolves the value of an input interface{} to a reflect.Value.
+func resolveValue(input any) (value reflect.Value, ok bool) {
+	v := reflect.ValueOf(input)
+	for v.IsValid() && (v.Kind() == reflect.Pointer || v.Kind() == reflect.Interface) {
+		if v.IsNil() {
+			return reflect.Value{}, false
+		}
+		v = v.Elem()
+	}
+	if !v.IsValid() {
+		return reflect.Value{}, false
+	}
+	return v, true
+}
+
+// ToBool converts an input value to a boolean.
+func ToBool(input any) (result bool, ok bool) {
+	v, ok := resolveValue(input)
+	if !ok {
+		return false, false
+	}
+
+	switch v.Kind() {
+	case reflect.Bool:
+		return v.Bool(), true
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() != 0, true
+	case reflect.Float32, reflect.Float64:
+		return v.Float() != 0, true
+	case reflect.String:
+		s := v.String()
+		if b, err := strconv.ParseBool(s); err == nil {
+			return b, true
+		}
+		return false, false
+	default:
+		return false, false
+	}
+}
+
+// ToInt64 converts an input value to an int64.
+func ToInt64(input any) (result int64, ok bool) {
+	v, ok := resolveValue(input)
+	if !ok {
+		return 0, false
+	}
+
+	switch v.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int(), true
+	case reflect.Float32, reflect.Float64:
+		return int64(v.Float()), true
+	case reflect.String:
+		s := v.String()
+		if i, err := strconv.ParseInt(s, 10, 64); err == nil {
+			return i, true
+		}
+		return 0, false
+	default:
+		return 0, false
+	}
+}
+
+// ToFloat64 converts an input value to a float64.
+func ToFloat64(input any) (result float64, ok bool) {
+	v, ok := resolveValue(input)
+	if !ok {
+		return 0, false
+	}
+
+	switch v.Kind() {
+	case reflect.Float32, reflect.Float64:
+		return v.Float(), true
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return float64(v.Int()), true
+	case reflect.String:
+		s := v.String()
+		if f, err := strconv.ParseFloat(s, 64); err == nil {
+			return f, true
+		}
+		return 0, false
+	default:
+		return 0, false
+	}
+}

x-pack/osquerybeat/ext/osquery-extension/pkg/filters/cast_test.go

@@ -0,0 +1,113 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package filters
+
+import "testing"
+
+func TestToBool(t *testing.T) {
+	type args struct {
+		input any
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{name: "bool_true", args: args{input: true}, want: true},
+		{name: "bool_false", args: args{input: false}, want: false},
+		{name: "bool_string_true", args: args{input: "true"}, want: true},
+		{name: "bool_string_false", args: args{input: "false"}, want: false},
+		{name: "bool_string_true_uppercase", args: args{input: "TRUE"}, want: true},
+		{name: "bool_string_false_uppercase", args: args{input: "FALSE"}, want: false},
+		{name: "bool_string_non_boolean", args: args{input: "not a boolean"}, want: false},
+		{name: "bool_int_1", args: args{input: 1}, want: true},
+		{name: "bool_int_0", args: args{input: 0}, want: false},
+		{name: "bool_int_non_boolean", args: args{input: 100}, want: true},
+		{name: "bool_float_1.0", args: args{input: 1.0}, want: true},
+		{name: "bool_float_0.0", args: args{input: 0.0}, want: false},
+		{name: "bool_float_non_boolean", args: args{input: 100.0}, want: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := ToBool(tt.args.input)
+			if !ok {
+				if tt.want == false {
+					return
+				}
+				t.Errorf("%s: ToBool() failed to convert input to bool", tt.name)
+			} else if got != tt.want {
+				t.Errorf("%s: ToBool() = %v, want %v", tt.name, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestToInt64(t *testing.T) {
+	type args struct {
+		input any
+	}
+	tests := []struct {
+		name string
+		args args
+		want int64
+	}{
+		{name: "int64_1", args: args{input: 1}, want: 1},
+		{name: "int64_0", args: args{input: 0}, want: 0},
+		{name: "int64_non_integer", args: args{input: 100.0}, want: 100},
+		{name: "int64_string_1", args: args{input: "1"}, want: 1},
+		{name: "int64_string_0", args: args{input: "0"}, want: 0},
+		{name: "int64_string_non_integer", args: args{input: "not an integer"}, want: 0},
+		{name: "int64_float_1.0", args: args{input: 1.0}, want: 1},
+		{name: "int64_float_0.0", args: args{input: 0.0}, want: 0},
+		{name: "int64_float_non_integer", args: args{input: 100.0}, want: 100},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := ToInt64(tt.args.input)
+			if !ok {
+				if tt.want == 0 {
+					return
+				}
+				t.Errorf("%s: ToInt64() failed to convert input to int64", tt.name)
+			} else if got != tt.want {
+				t.Errorf("%s: ToInt64() = %v, want %v", tt.name, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestToFloat64(t *testing.T) {
+	type args struct {
+		input any
+	}
+	tests := []struct {
+		name string
+		args args
+		want float64
+	}{
+		{name: "float64_1.0", args: args{input: 1.0}, want: 1.0},
+		{name: "float64_0.0", args: args{input: 0.0}, want: 0.0},
+		{name: "float64_non_float", args: args{input: 100}, want: 100.0},
+		{name: "float64_string_1.0", args: args{input: "1.0"}, want: 1.0},
+		{name: "float64_string_0.0", args: args{input: "0.0"}, want: 0.0},
+		{name: "float64_string_non_float", args: args{input: "not a float"}, want: 0.0},
+		{name: "float64_int_1", args: args{input: 1}, want: 1.0},
+		{name: "float64_int_0", args: args{input: 0}, want: 0.0},
+		{name: "float64_int_non_float", args: args{input: 100}, want: 100.0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := ToFloat64(tt.args.input)
+			if !ok {
+				if tt.want == 0.0 {
+					return
+				}
+				t.Errorf("%s: ToFloat64() failed to convert input to float64", tt.name)
+			} else if got != tt.want {
+				t.Errorf("%s: ToFloat64() = %v, want %v", tt.name, got, tt.want)
+			}
+		})
+	}
+}