Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi Kolide team! Where in the fleet source code is the live shell on a host feature implemented? Thanks :slightly_smiling_face:

Fleet doesn't implement the live shell functionality. Are you looking for the client implementation in Launcher?

Yes, sorry, I was using `<http://kolide.com|kolide.com>`, not fleet

Where would I find it in launcher then? :slightly_smiling_face:

Yep, give me a minute to find that for ya.

<https://github.com/kolide/launcher/tree/master/pkg/control>

Awesome, I don’t understand any of the code at all, but I’ll try to figure it out :slightly_smiling_face:

I’m guessing these files just expose a `/api/v1/shells` endpoint, where you POST a shell command for a specific device and it returns the output of the shell command as JSON

Not exactly. The Launcher opens a real shell on the host and a bidirectional communication channel with the server.