lankesh
06/27/2022, 5:25 AMkoo
06/27/2022, 7:45 AMMike Myers
06/27/2022, 3:51 PMlankesh
06/27/2022, 4:09 PMStefano Bonicatti
06/27/2022, 4:11 PMlankesh
06/27/2022, 4:14 PMStefano Bonicatti
06/27/2022, 4:16 PMosqueryd -S "select * from osquery_info" --json
and parse the output, but it's less than ideallankesh
06/27/2022, 4:23 PMStefano Bonicatti
06/27/2022, 4:33 PMosqueryi
as previously mentioned, or you could also decide to write an extension that communicates via the Thrift APIs with osquery and works as a bridge between your processes and osquery.
Here you're a bit on your own because again it's not exactly what they were intended for.
Extensions are external processes that register and communicate with the osquery daemon through the Thrift APIs. They can provide new tables, logger plugins or config plugins. https://osquery.readthedocs.io/en/latest/deployment/extensions/lankesh
06/27/2022, 4:41 PM