Hey folks! Does anyone here have experience implementing new evented tables, particularly in macOS/openbsm? I am trying to implement a socket_events table on macOS but am unsure which files are needed to accomplish this. If anyone could give me a high level overview of what I need to do, I would appreciate it! Thanks!

Have you taken a look at https://osquery.readthedocs.io/en/latest/development/pubsub-framework/? You'll need to implement an event publisher and a subscriber. I've done this before, for example in https://github.com/osquery/osquery/pull/1961/files.

This is great, thanks! The pr shod definitely help. I’m trying to essentially create a new openbsm event subscriber by copying the code in /osquery/osquery/tables/events/darwin/openbsm_events.cpp and modifying it to pull openbsm network events.

Yeah total bonus if you can just create a subscriber!

Absolutely! Also, just played with kolide fleet in my environment and built a proof of concept using it..seriously amazing work! We are going to implement it here very soon.

Awesome, glad to hear it!

Okta

Oh nice, I know y'all have been playing with osquery for some time now.

Yep, I’m fairly new here but trying to overhaul things. I’ll definitely keep you in mind and appreciate your time and help!

There are good osquery folks here. (as well as kolide and other vendors)