https://github.com/osquery/osquery logo
Title
c

charles

11/29/2022, 10:41 PM
does anyone ship custom osquery tables with their fleet installs today? it seems supported but wanted to know if there were any real hairy details
s

Stephan M

11/29/2022, 10:45 PM
Yup we do and have for a couple of years. Has worked well so far
c

charles

11/29/2022, 11:07 PM
sweet, awesome to hear! do you happen to do this with only linux or windows/mac too?
s

Stephan M

11/29/2022, 11:11 PM
Only linux at the moment
r

Ryan

11/30/2022, 12:28 PM
same here, Linux only, but it seems to work well - we install them alongside osquery itself, and they are then available for Fleet to query, though of course it doesn’t show the schema of the custom tables because it doesn’t know it
c

charles

11/30/2022, 10:22 PM
yea that's alright. do either of you use orbit or just manage osquery directly?
s

Stephan M

11/30/2022, 10:23 PM
We do both. We have a couple thousand where we manage osquery alone as we don't like unscheduled change there and then 10k+ where orbit just takes care of it. It would be nice if we could tell fleet about our custom tables so that the UI querying is a nicer experience.
t

Terje Kvernes

12/01/2022, 9:00 AM
@Stephan M These tables you ship, do they reset when fleet is restarted?
r

Ryan

12/01/2022, 10:33 AM
we do it directly because we already had automation in place
m

Mystery Incorporated

12/02/2022, 5:18 AM
Are these tables added by a plugin/extension to osquery?
s

Stephan M

12/02/2022, 5:22 AM
In our case we have puppet lay down the extensions. In terms of the reset during a restart, I'm not sure. I wouldn't expect it to because as far as I understand it there is a local DB kept in osquery where these results are kept and that survives a restart but I'm not 100% sure