Yves Dolce
01/23/2020, 11:55 PMsdk.h
is under osquery\osquery\sdk
but events.h
is under osquery\osquery\include\osquery
.
There's no dispatcher.h
header file but a osquery\osquery\dispatcher
folder. Same for database.h
, just database folders.
Yet I look around at existing extensions and I see:
#include <osquery/database.h>
#include <osquery/dispatcher.h>
#include <osquery/events.h>
#include <osquery/sdk.h>
Do I need to successfully build osquery to start developing extensions?alessandrogario
01/24/2020, 1:47 PMYves Dolce
01/24/2020, 8:49 PMsdk.h
is at osquery\sdk\sdk.h
yet it does #include <osquery/sdk.h>
.
2. I thought that the difference between an extension and a plugin is that the former can be out-of-proc, independently built from osquery (although it does need to reference some files from it). Am I wrong?alessandrogario
01/24/2020, 11:45 PMYves Dolce
01/24/2020, 11:49 PMalessandrogario
01/24/2020, 11:50 PMYves Dolce
01/25/2020, 12:00 AMalessandrogario
01/25/2020, 12:00 AMYves Dolce
01/25/2020, 12:01 AMalessandrogario
01/25/2020, 12:01 AMYves Dolce
01/25/2020, 12:03 AMalessandrogario
01/25/2020, 12:05 AMYves Dolce
01/25/2020, 12:05 AMExtensionManagerClient
, with VS, outside the osquery
folder tree. Is this possible?