Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

so, that talk where the guy showed a ./query-bpf (which I searched for and couldn’t find) that created and deployed a program and filter and showed the events - that’s possible in osquery?

think it was the talk about writing viaual bpf programs - i don’t much care about the visual part though, but being able to write a query and have everything deployed and get feedback sounds really slick

This was something I asked <@U6EFFT5FG> about in office hours this week. He says it will be possible to allow dynamic ebpf programs to be loaded in osquery (don't think there's a timeline yet).

Related <https://asciinema.org/a/419326|https://asciinema.org/a/419326>