Hello everyone, I am new here . i need guidance to develop osquery extension of our EDR tool so that we can plugin with it, but confused from where we should start ?

Hello Priya! Here's how to get started: • Go: https://github.com/osquery/osquery-go • Rust: https://github.com/withzombies/osquery-rust • Python: https://github.com/osquery/osquery-python • C++: https://github.com/osquery/osquery/tree/master/external/examples The C++ ones will have to be built with osquery, by copying or linking the extension's source code folder inside the osquery source tree

can i start with python

Sure! You can follow the README to get started

I forked the osquery-rust project and extended it and updated it: https://crates.io/crates/osquery-rust-ng I added config and logger plugins, as well as writeable tables

currently i am doing packet sniffing so that we can develop "osquery_extension" - during packet sniffing i want to store [Date | time |domain | URL | User | source& destination IP & port| TLS_certifying_authority | TLS_protocol, ------- I am trying with scapy library, # anyone suggest which library we should use so that we can capture all these details