Hi everyone, is it possible to HTTP GET my (scheduled) queries? I don't find any information about that 😞

Hi there @Jens Willmer , is this question related to #fleet by any chance? can we hop in there if so, thanks!

hi @sharvil, no, I have osquery installed on a server and experimented with the sql queries. Now I would like to use my workflow automation system to query predefined queries (via HTTP?) every now and then. Is this possible?

Now I would like to use my workflow automation system to query predefined queries (via HTTP?) every now and then. Is this possible?

I am not completely sure to be honest, I think something (which could be your workflow automation system) would have to implement the osquery remote APIs (https://osquery.readthedocs.io/en/latest/deployment/remote/#remote-server-api) and then would have to ad-hoc do a query to

osquery_schedule

table, I don't know if there is a simpler way though

Yes, that I can do. It's just not very obvious which endpoints I need to have and how we need to function. I was hoping for an endpoint which requires a auth token and thats it. Seams not so straight forward. I also looked into fluentd as a middle man but I dont find any tutorial/example of connecting them together.

I am not too familiar with fluentd — do you have the ability to ship the logs on disk from the host — might be worth experimenting with adding

select * from osquery_schedule

query to the schedule, and have the osquery

results.log

shipped out

ah, so I could schedule my queries to log them to file and then just take the file. Yes, that would work for me. I will give it a try 🙂

I am not sure about the latest -- but I believe you can get pretty close by using the

batch

format along with

differential

when configuring the logging -- https://osquery.readthedocs.io/en/latest/deployment/logging/#event-format

I think I have to connect to some logging service. The rotate is a good idea but with multiple queries scheduled in different steps it is not working. But thanks for the ideas. helped me to understand the posibillities 🙂

I’m a bit unsure what you’re asking after.