Hi, I'm new to osquery. Can you change configuration via osquery? I see some hints that it's possible from Slack here, but the official docs seem to say you can't (https://osquery.readthedocs.io/en/stable/introduction/sql/#sql-as-understood-by-osquery). Thanks!

Yes but only with osquery extensions. In an extension, a table can/could be implemented that changes the host configuration.

Welcome! What do you mean by “change configuration”? Can you describe at a high level what you are looking to accomplish?

Mike may have answered it. Consider something like the hosts file (https://osquery.io/schema/4.4.0/#etc_hosts) Can I "INSERT INTO etc_hosts "myhostname" "10.0.0.1"" and update the system's hosts file? (ignoring invalid SQL syntax)

Got it, yeap! There should be some example extensions that do INSERTs. @Mike Myers know of any we can link Sean to?

Hey, I just got back from PTO. Yes, we have the code at https://github.com/trailofbits/osquery-extensions/tree/master/fwctl that demonstrates a table that implements an

INSERT

and

DELETE