https://osquery.readthedocs.io/en/stable/deployment/extensions/ should have some info (but it seems to be broken at the moment? won't load for me)