Sorry if this has been asked before but is there documentation support for querying custom tables in osquery using fleet? I can query it using osqueryi but fleet fails to produce results.
08/26/2020, 7:52 PM
You query them the same way as any other table. If that's not working it is probably because you have not configured osqueryd to include the table.
You can use
select * from osquery_tables
08/26/2020, 8:00 PM
Appreciate your prompt response. I have setup my endpoint using the launcher so I did not configure osqueryd at all
I tried checking osquery_extensions table and it shows there is one connection (I only have one custom table at the moment at the endpoint). The output is ambiguous because it does not show extension name
08/26/2020, 8:47 PM
Sounds like your extension is not connected. I'm not sure there is a way to include additional extensions with Launcher unless you modify the source code yourself.
08/26/2020, 9:26 PM
Okay so osqueryd configuration is the only option
08/26/2020, 9:44 PM
Is this an extension? Launcher starts osqeryd with an
is additive, you could use that.I could imagine supporting this in launcher, but I’m not up for writing that PR this week
08/26/2020, 10:13 PM
Yes, it is an extension. I will need to use the
flag with osqueryd as you and @zwass have pointed out. Thank you both!