Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Has anyone built an extension in C#? I think it is possible as Thrift supports it from my reading, but then I can see that it says the extension must import the core code which is c++ so can it be done?

You can write an extension in _any_ language that only communicates over thrift. (including c, c++, c#….)

There are some fragments of support for building “extensions” in c languages that use some of the core libraries. I’m not sure it’s common, and it’s probably just confusing,

I’m not sure there’s an SDK for c#. There’s a go SDK, and a python SDK. But thrift is thrift, and I’ve certainly done things from ruby.

I think you can ignore anything about importing core code, and write a standalone extension that uses the thrift socket.

You may wish to start here <https://github.com/noghte/osquery-csharp|https://github.com/noghte/osquery-csharp>