Does Windows version of OSquery support Socket events and Pr

Question

Does Windows version of OSquery support Socket events and Process events tables From my understanding it does not From Linux platform linux schedule process events query SELECT auid cmdline ctime cwd egid euid gid parent path pid time uid FROM process events interval 10 description Process events collected from the audit framework socket events query SELECT action auid family local address local port path pid remote address remote port success time FROM socket events WHERE remote address NOT IN 127 0 0 1 interval 10 description Socket events collected from the audit framework I am trying to figure out windows equivalent of these queries

zwass · Answer

<http osquery io schema|osquery io schema> is your friend here

zwass · Answer

Those tables are not supported on windows

Shan · Answer

thats what my understanding was thanks < zwass>

Shan · Answer

While at it Zach < zwass> I would like to contribute for these tables for Windows I have started reading on this topic If there is already some known work or windows equivalent of auditD etc please share it will come in handy

Mike Myers · Answer

Windows equivalent of AuditD would be ETW but the last time I looked there was no ETW publisher you could turn on that would correlate process events and socket events You had to attempt to do it yourself but that approach is prone to race conditions

Mike Myers · Answer

We did it anyway and it became this <https github com DigitalOperatives PAINT>

Mike Myers · Answer

The reliable way to do it is with a kernel mode driver but that violates osquery design principles

Mike Myers · Answer

Windows also has process auditing but osquery would have to enable that as a policy change on the host and that s also against osquery design principles changes to host configs

zwass · Answer

There are a handful of osquery tables that require users to change host configs for deployment Could that be solution here

OpenPlgx · Answer

< Shan> at PolyLogyx we have built these tables thru an extension not the core as they leverage kernel components If it interests you feel welcome to pick the extension from

OpenPlgx · Answer

For more you can check on polylogyx extension channel

Shan · Answer

Will do thanks for the info guys appreciate it