Dhruv Rathod

10/27/2021, 8:39 AM
Hi all is there any way to use the osquery sdk as a way of querying a device without using osqueryi/osqueryd? or is the sdk just intended to create extensions?


10/27/2021, 11:39 AM
osquery, when running, has an interface presented by thrift. While this is usually used for extensions, we do have a thrift api for querying
11:39 AM
You need an osquery running, and you need write access to the socket
11:41 AM
In ruby. you’d use:
client = Osquery::Extensions::ExtensionManager::Client.new(@protocol)
There’s an example of this in the go sdk — https://github.com/osquery/osquery-go/blob/master/examples/query you’ll need to chase down what the library is doing if you want to see the various moving parts.
11:41 AM
Since this is all in the thrift spec, it should be pretty much the same everywhere

Dhruv Rathod

10/27/2021, 12:14 PM
okay so as it is using thrift api, I can use any language to communicate with it, right? but it specifically needs either the daemon or interactive shell to be running, right?
Mike Myers

Mike Myers

10/27/2021, 4:06 PM
any language with Thrift support, but the answer is yes probably.
4:07 PM
the osquery agent has to be running, in either interactive or daemon mode yes
4:08 PM
a lot of people have asked for an
situation, but that isn't possible with what exists today

Dhruv Rathod

10/27/2021, 6:13 PM
Oh, alright. Thanks for your help though!