hi,
Wanted to use osquery in C++ to get the basic details like os version, firewall status, etc.
Was trying to experiment with Thrift IPC but not sure.
what's the way forward. any sample for the same will help.
m
Mike Myers
05/18/2021, 6:30 AM
Yes. To use it, you run it as a daemon and write an extension — or, you can run it interactively as a subprocess. If you're writing an extension it doesn't need to be C++ necessarily, other languages are supported.
thank you mike. I was confused with the Extension docs. I thought Extension is written to extend the functionality of osquery which is not my requirement. i just wanted to use existing.
I don't want to use osqueryi. and C++ is a requirement.
So just to confirm, are Extensions, the way to use osquery SDK?
m
Mike Myers
05/18/2021, 7:05 AM
Yea, osquery doesn't build to be included or compiled as a library callable within your process
a
Abhijit
05/18/2021, 7:23 AM
oh...that's clear now. Thank you Mike very much.
The trailofbits sample you pointed are amazing. It seems they are extending osquery's functionality.
Any simple C++ extension which just queries the existing tables of osquery like OS version will help. I don't want to extend anything.
Any pointers to such samples?
meep cool 1
m
Mike Myers
05/18/2021, 5:19 PM
Ah, well the extension doesn't have to register any new tables I guess, but I'm not sure how to just ask osquery for things over Thrift. I haven't seen an example of what you're asking, but maybe in #extensions someone could help
a
Abhijit
05/19/2021, 7:44 AM
thank you Mike.
s
seph
05/20/2021, 1:44 AM
The go SDK supports that and launcher uses it for a couple things
a
Abhijit
05/20/2021, 10:40 AM
Okay. Thank you!
s
seph
05/25/2021, 1:58 AM
By implication… Anything using thrift supports that. Though it may or may not be easily exposed or documented