{"repo":"osquery/osquery-go","free":true,"listed":false,"github":"https://github.com/osquery/osquery-go","clone":"git clone https://github.com/osquery/osquery-go.git","description":"Go bindings for osquery","language":"Go","stars":432,"topics":["osquery","golang","thrift"],"license":"MIT","category":"databases-storage","readme_excerpt":"osquery-go osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes. If you're interested in learning more about osquery, visit the GitHub project, the website, and the users guide. What is osquery-go? In osquery, SQL tables, configuration retrieval, log handling, etc. are implemented via a robust plugin and extensions API. This project contains Go bindings for creating osquery extensions in Go. To create an extension, you must create an executable binary which instantiates an ExtensionManagerServer and registers the plugins that you would like to be added to osquery. You can then have osquery load the extension in your desired context (ie: in a long running instance of osqueryd or during an interactive query session with osqueryi ). For more information about how this process works at a lower level, see the osquery wiki. Install This library is compatible with Go Modules. To install: Using the library Creating a new osquery table If you want to create a custom osquery table in Go, you'll need to write an extension which registers the implementation of your table. Consider the following Go program: To test this code, start an osquery shell and find the path of the osquery extension socket: Then start the ","default_branch":null,"files":null,"tree":[],"storefront":"/r/osquery","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/osquery/osquery-go/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}