Skip to content

[osquerybeat] Add elastic_browser_history spec#48733

Open
marc-gr wants to merge 5 commits intoelastic:mainfrom
marc-gr:feat/osquery-browser-hist-spec
Open

[osquerybeat] Add elastic_browser_history spec#48733
marc-gr wants to merge 5 commits intoelastic:mainfrom
marc-gr:feat/osquery-browser-hist-spec

Conversation

@marc-gr
Copy link
Contributor

@marc-gr marc-gr commented Feb 6, 2026

Proposed commit message

Convert the elastic_browser_history table to use the spec.
This will autogenerate and validate the types, documentation, and table registration.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
  • I have added an entry in ./changelog/fragments using the changelog tool.

- Updated osqueryTypeToGoType function to include mapping for BOOLEAN and BOOL to Go's bool type.
- Enhanced README to reflect the addition of BOOLEAN in the column type specifications.
… and structure

- Changed the README to link to the new documentation file for the elastic_browser_history table.
- Deleted the old documentation file and created a new structured documentation file under docs/tables.
- Registered the elastic_browser_history table across all platforms (Linux, macOS, Windows) with appropriate schema and examples.
- Enhanced the generated code for the elastic_browser_history table to include detailed column definitions and data model descriptions.
…lt structs

- Introduced a new `Result` struct for browser history entries, enhancing type safety and clarity.
- Updated parsing functions across Chromium, Firefox, and Safari to return the new `Result` type instead of the previous `visit` type.
- Replaced instances of `GetTableRows` with a new helper function `getResultsAsMaps` for test data conversion.
- Removed the deprecated `visit` struct and related functions to streamline the codebase.
- Enhanced error handling and logging during browser history parsing.
…m all platforms

- Removed the registration of the `elastic_browser_history` plugin from the macOS, Linux, and Windows implementations.
@marc-gr marc-gr requested a review from a team as a code owner February 6, 2026 15:59
@marc-gr marc-gr added enhancement Osquerybeat backport-skip Skip notification from the automated backport with mergify Team:Security-Windows Platform Windows Platform Team in Security Solution labels Feb 6, 2026
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Feb 6, 2026
@elasticmachine
Copy link
Contributor

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Feb 6, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 6, 2026

🤖 GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@github-actions
Copy link
Contributor

github-actions bot commented Feb 6, 2026

Vale Linting Results

Summary: 7 warnings, 3 suggestions found

⚠️ Warnings (7)
File Line Rule Message
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 28 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 49 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 50 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 165 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 187 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 189 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 190 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
💡 Suggestions (3)
File Line Rule Message
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 26 Elastic.Semicolons Use semicolons judiciously.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 28 Elastic.Semicolons Use semicolons judiciously.
x-pack/osquerybeat/ext/osquery-extension/docs/tables/elastic_browser_history.md 189 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-skip Skip notification from the automated backport with mergify enhancement Osquerybeat Team:Security-Windows Platform Windows Platform Team in Security Solution

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants