Usually I’m able to figure stuff out but C++ always kicks my butt.

For the record, I’m not stuck on this ide and if you’re more familiar with another one I’d gladly switch to get up and running.

The problem is the imports to osquery sdk don’t seem to resolve, and the docs I read to compile the sample extension won’t even work.

Trying to separate what’s an IDE configuration vs a build tool chain.

If you start with a clean checkout, do the build instructions work?

Or you can use

osqueryd -S

I have no useful advice — I don’t use IDEs. But if you get good instructions, it’s worth documenting

I’m fine with not using an ide honestly, as long as I’m able to make minor changes to code and rerun to test changes without rebuilding the whole package. Any command line guidance you can give me for that would be great.

Personally, I use emacs and vi. I don’t feel like I can comment on coding environment. I expect most things will work, though there may be some weirdness around the edges

Is the command to compile/build changes different?

I would not re-run cmake unless you’re changing cmake files. I don’t know if it should error out, that seems weird

Ok good, so I’m not sure if you have any experience with developing the event based tables, particularly on macOS, but I’m trying to essentially create a new openbsm event subscriber by copying the code in /osquery/osquery/tables/events/darwin/openbsm_events.cpp and modifying it to pull openbsm network events.

Is this a subset of the bsm data? If so, does it merit a new table? Or is it data in another?

Yes this data should be captured in openbsm/audit code already implemented. I just need to add an event handler and call back for these particular event types and parse the fields into a table.

Theoretically I know what I need to do but not great at c++ and have no knowledge of the codebase

I am basically trying to implement a socket_events table for macOS like the one in Linux.

But I’d probably recommend asking in #general, and not in the bottom of this thread about IDEs 🙂

https://github.com/osquery/osquery/pull/5488 is a PR for a table we decided not to include. But it’s a pretty simple example.

I’d generally start by reading a table spec, say

specs/darwin/disk_events.table

and then digging into how it’s implemented.

implementation("events/darwin/disk_events@disk_events::genTable")

But I know there’s another piece to understand in events

Reading old PRs can help. Or digging through some of the docs

Great I’ll def do that