Is there a Python service for OSQuery?

There's a Python SDK for writing osquery extensions. https://github.com/osquery/osquery-python - but I'm not sure what you are asking for.

That is what I was looking for, just saw it wasn't updated in 2 years and thought it might have been abandoned.

It still seems to do the trick. We've got several extensions using it and Python 3.11.x

Just ripped through the setup stuff. Nothing is hard coded with top level versions. I was concerned about introduced vulnerabilities because some requests or argparse was set to a version from 4 years ago. Thanks for your time.

The underlying thrift API hasn’t changed. And I’m not sure how much changes in python. It’s still current.

Most folks are writing extensions in Go these days.

Some folks. 😆

Some are doing C++ as well haha. All should still work.

Whats it at around now... 7 to 1 on the Python vs Go developers?

We did use Go on Windows, so ¯\_(°_o)_/¯

Go is what we use at Fleet and recommend to our customers. It's also what the macadmins extensions and Kolide use. Trail of Bits uses C++ for their extensions. AFAIK we are all the biggest open source extension users. Not sure what Crowdstrike, Microsoft, etc. are using for their own extensions.

I was going to use swift and look at packaging this all together right on to the app store. Just simply download from apple and you can get a bunch of stuff like vulnerabilities and compliance.

Ooh fun! I'm not sure whether there's Thrift support in Swift but if so you could write your own SDK/integration. You could also just shell out to osquery which is sometimes easiest depending on your use case.

Right now I have just been shelling it off. Which isn't super ideal.

ooh that all sounds fun!

It is my "dream" that vulnerability conversion rules don't need to be managed independently by each of the scanners out there... Whether that is Rapid7, FleetDM, Jamf, Crowdstrike, etc. Each of those entities don't need to keep and maintain a

"well google:chrome is com.google.chrome"

It would be awesome to have a utility like apple does with mSCP where all of the management vendors use the same core product/service that is industry maintained and they instead work on how they want to use those detections, events, and data in their general walled garden. So that is my passion build project and figuring out how to make that happen through my post graduate stuff..

Happy to promote/repost on LinkedIn or Twitter if you have some open source work to share 🙂