Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

when building osquery from source, is it possible to customise the build script to add postflight scripts (eg move the plist &amp; load it) if so, where is the build script?

The package built? That’s cmake’s `cpack` does that. I’m not sure what customizing options you have. I tend to just make my own packages.

You can update the packaging.cmake file and add

```set(CPACK_PREFLIGHT_APPLICATIONBUNDLE_SCRIPT "/path/to/preflight.sh")
set(CPACK_POSTFLIGHT_APPLICATIONBUNDLE_SCRIPT "/path/to/postflight.sh")```

not familiar with how we handle packaging on macOS; if we already have those two files you may have to edit them

thank you, I can't see it is set in the current cmake file - will test it out though

<@U6EFFT5FG> do I need to put that in a specific bit of the packaging.cmake file for macos packages? so far It's not executing for me - at this point just trying to get it to run the included `osqueryctl start`

It should be inside an if(PLATFORM_MACOS) block, like here: <https://github.com/osquery/osquery/blob/master/cmake/packaging.cmake#L367>

then the `make package` command should import those two files in the .pkg