Hello. As osquery populates file table dynamically during queries, is there some extension that performs the data collection on its own and then supplies the data to osquery tables? I mean this could be useful for scanning large folders for info about particular files and their properties (file version, product version, size...)

I’m not sure what you’re describing. Can you say more?

Querying properties (file version, product version, size..) of all "versioned" files in particular large folder. Osquery could listen for changes of files in particular folder and keep the table updated. Instead, it makes it impossible to query such a large folder as it would take many minutes or it would require developing own extension which collects the data independently and then feeding osquery.

When you say listening for changes, that sounds a like like the file integrity monitoring stuff. You should check that out.

I think of something like https://stackoverflow.com/questions/29066742/watch-file-for-changes-and-run-command-with-powershell That a change in a monitored folder would trigger a scan of a changed file, which would keep the table up to date at all times.

As said, look at the file integrity monitoring

I don't care about the change as such, I only care about having a complete view of file version, product version and file size. But I get that it is not something that's planned for osquery. Thanks for your answers though.

Right -- you'd use a FIM to join against the file table and get the full file info