Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello! I've got a question regarding integration with Slack Webhooks. Device: Raspberry pi 3B+ running Ubuntu 22.04 server. I am wanting checks with osquery to happen everyday on the same hour. Once the query happens, I want a message to be sent via slack web hooks to let me know what the results were of the query, whether the device is compliant or not(true or false)

osquery is not a server, and it does not support webhooks. Are you asking about some fleet manager?

Is that how I would integrate slack webhooks(being notified by anything done by osquery)?

osquery is an agent. It runs on devices and gathers data based on it’s configuration. Osquery either writes the results to a local file, or to a remote endpoint.

There are a variety of commercial and open source remote managers for it.

For an intro to osquery, check out <https://osquery.readthedocs.io/>

If you wanted to write your own server, note <https://osquery.readthedocs.io/en/latest/deployment/remote/>

If you wanted to find an open source or commercial one, search the internet or see who pops up on <#C08V7KTJB|general>

Thanks for all the guidance! Much appreciated!