Osquery: An sqlite3 virtual table exposing operating system data to SQL

Re:Osquery: An sqlite3 virtual table exposing operating syst... by archsurface on Sunday February 25, 2024 @12:18PM (#39502586)

I like the idea, but the queries seem to be longer than the shell commands, so the only advantage is not having to know the shell commands, and I'm not convinced you want people who don't know the system mucking about on the system.

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by riku_iki on Sunday February 25, 2024 @12:27PM (#39502683)

its also useful when you are building some telemetry agent, since you don't need to parse output of each individual command

[ Parent | on HN ]

Re:Osquery: An sqlite3 virtual table exposing operating syst... by mikermcneil on Sunday February 25, 2024 @06:17PM (#39505960)

me and my brother-in-law Eric built this table viewer: https://fleetdm.com/tables

(it's got an extra layer of metadata with examples. Supports markdown in the yaml for most fields. Contributions welcome!!)

[ Parent | on HN ]