Is it possible to add the description or other custom field to query result log?

Question

I have the following scheduled query in combination with a TLS plugin logger.

"vssadmin.exe": {
        "query": "select * from file WHERE directory = 'C:\\Windows\\Prefetch\\' and filename like '%vssadmin%';",
        "interval": 600,
        "description": "Vssadmin Execute, usaullay used to execute activity on Volume Shadow copy",
        "platform": "windows"
    },

I'd like to add the description field to the result output log of this specific query, so I can use it to map my queries to a framework. Unfortunately the provided documentation doesn't state such option. Is it possible to add the description or other custom field to the logged output?

Answer 1

Like this?

Tag your #osquery queries/logs with MITRE ATT&CK IDs like so:

SELECT username,shell, 'T1136' AS attckID FROM users;