Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
d
Dhruv Rathod
10/27/2021, 8:39 AMHi all
is there any way to use the osquery sdk as a way of querying a device without using osqueryi/osqueryd?
or is the sdk just intended to create extensions?
s
seph
10/27/2021, 11:39 AMosquery, when running, has an interface presented by thrift. While this is usually used for extensions, we do have a thrift api for querying
You need an osquery running, and you need write access to the socket
In ruby. you’d use:
client = Osquery::Extensions::ExtensionManager::Client.new(@protocol)
client.query(statement)Since this is all in the thrift spec, it should be pretty much the same everywhere
d
Dhruv Rathod
10/27/2021, 12:14 PMokay so as it is using thrift api, I can use any language to communicate with it, right? but it specifically needs either the daemon or interactive shell to be running, right?
m
Mike Myers
10/27/2021, 4:06 PMany language with Thrift support, but the answer is yes probably.
the osquery agent has to be running, in either interactive or daemon mode yes
a lot of people have asked for an
osquery.libd
Dhruv Rathod
10/27/2021, 6:13 PMOh, alright. Thanks for your help though!
😄 1