https://github.com/osquery/osquery logo
d

Daniel Bretón Suárez

12/22/2022, 4:25 PM
Hey @Stefano Bonicatti, I've found out I must attach the table previously to perform the SQL command. Something like this:
Copy code
auto st = osquery::Registry::call("sql", "sql",
                                    {{"action", "attach"}, 
                                    {"table", "system_info"}}, response);
And then I can use the SQL engine with that table as usual
Copy code
osquery::SQL sql("SELECT * FROM system_info;");
So, it seems like not all tables are loaded by default into extension registry
2 Views