https://github.com/osquery/osquery logo
Title
a

ApoC

10/15/2020, 9:32 AM
Hello is it possible to get from OsQuery events asynchonously without periodic querying? For example process creation, file modifications etc? My idea is trigger specifix queries based on this async events, if OsQuery can provide them. Thank You.
a

alessandrogario

10/15/2020, 10:27 AM
It's slightly different, but in the past people thought about adding an option to bypass tables and have event subscribers send events directly through the logger. I don't think an agreement was reached on whether it fit osquery or not. One thing that can be done here is to schedule a query using a 'discovery query': https://osquery.readthedocs.io/en/stable/deployment/configuration/#discovery-queries The discovery query would contain the event trigger (example:
SELECT * FROM process_events WHERE path = sudo
), and the body would contain the query you want to run in response to this event.
a

ApoC

10/15/2020, 11:33 AM
ok, ïll take a look into it, thank You
s

seph

10/15/2020, 2:33 PM
IIRC discovery queries have weird cache intervals, so that might not work as expected
I don’t think osquery has a simple capability to trigger like that.
z

zwass

10/15/2020, 3:50 PM
I wonder what the behavior would be of a discovery query on an evented table like that. My guess would be that it does not do what you are looking for in this scenario.
a

ApoC

10/15/2020, 4:01 PM
thx all
a

alessandrogario

10/15/2020, 4:07 PM
Ah that's too bad! I was hoping it would kind of work with some tweaks on events expiry/max events