https://github.com/osquery/osquery logo
Title
a

Abhijit

05/18/2021, 6:04 AM
hi, Wanted to use osquery in C++ to get the basic details like os version, firewall status, etc. Was trying to experiment with Thrift IPC but not sure. what's the way forward. any sample for the same will help.
m

Mike Myers

05/18/2021, 6:30 AM
Yes. To use it, you run it as a daemon and write an extension — or, you can run it interactively as a subprocess. If you're writing an extension it doesn't need to be C++ necessarily, other languages are supported.
We've written some extensions here https://github.com/trailofbits/osquery-extensions There is also the #extensions channel in this Slack, and the sample extension in the core repo
You probably saw this part of the documentation https://osquery.readthedocs.io/en/latest/development/osquery-sdk/
a

Abhijit

05/18/2021, 6:44 AM
thank you mike. I was confused with the Extension docs. I thought Extension is written to extend the functionality of osquery which is not my requirement. i just wanted to use existing. I don't want to use osqueryi. and C++ is a requirement. So just to confirm, are Extensions, the way to use osquery SDK?
m

Mike Myers

05/18/2021, 7:05 AM
Yea, osquery doesn't build to be included or compiled as a library callable within your process
a

Abhijit

05/18/2021, 7:23 AM
oh...that's clear now. Thank you Mike very much. The trailofbits sample you pointed are amazing. It seems they are extending osquery's functionality. Any simple C++ extension which just queries the existing tables of osquery like OS version will help. I don't want to extend anything. Any pointers to such samples?
:meep_cool: 1
m

Mike Myers

05/18/2021, 5:19 PM
Ah, well the extension doesn't have to register any new tables I guess, but I'm not sure how to just ask osquery for things over Thrift. I haven't seen an example of what you're asking, but maybe in #extensions someone could help
a

Abhijit

05/19/2021, 7:44 AM
thank you Mike.
s

seph

05/20/2021, 1:44 AM
The go SDK supports that and launcher uses it for a couple things
a

Abhijit

05/20/2021, 10:40 AM
Okay. Thank you!
s

seph

05/25/2021, 1:58 AM
By implication… Anything using thrift supports that. Though it may or may not be easily exposed or documented