Is anyone using the

jetbrains_plugins

table with success? I'm unable to get it to return results on hosts that have jetbrains plugins installed. Trying both via osqueryi locally and w/ distributed queries via Fleet.

I've just tried against a VM from my test instance and was able to return results for a couple of plugins for DataGrip using the example query:

select * from users cross join jetbrains_plugins using (uid)

Don't forget to restart the IDE after installing a plugin, otherwise it may not have created the /plugins/ folder yet. Hope that helps 🙂

These are files in other users homesites? Are you running osquery with enough permissions?

Thanks @Gray Williams that query w/ the cross join worked just fine, the inner join I used before didn't. This is the query that didn't work:

SELECT
  users.username,
  jetbrains_plugins.name AS plugin_name,
  jetbrains_plugins.version,
  jetbrains_plugins.path AS plugin_path
FROM
  jetbrains_plugins
JOIN
  users
ON
  jetbrains_plugins.uid = users.uid;