### Start osquery Daemon

Source: https://osquery.readthedocs.io/en/stable/installation/install-linux

These commands are used to start the osquery daemon. First, copy the example configuration file to the osquery configuration directory, then start the service using systemctl.

```bash
sudo cp /opt/osquery/share/osquery/osquery.example.conf /etc/osquery/osquery.conf
# sudo service osqueryd start
sudo systemctl start osqueryd
```

--------------------------------

### Manually Install osquery Daemon Configuration and LaunchDaemon

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

Manually copy the example configuration and launch daemon plist file into place, then load the launch daemon.

```bash
sudo cp /var/osquery/osquery.example.conf /var/osquery/osquery.conf
sudo cp /var/osquery/io.osquery.agent.plist /Library/LaunchDaemons
sudo launchctl load /Library/LaunchDaemons/io.osquery.agent.plist

```

--------------------------------

### Load Example Extension in Osqueryi

Source: https://osquery.readthedocs.io/en/stable/development/osquery-sdk

Start the osquery interactive shell and inspect the socket path. Suspend the shell to load the extension.

```bash
$ ./build/darwin/osquery/osqueryi
osquery> SELECT path FROM osquery_extensions;
+-------------------------------------+
| path                                |
+-------------------------------------+
| /Users/USERNAME/.osquery/shell.em   |
+-------------------------------------+
osquery> ^Z
[1]  + 98777 suspended  ./build/darwin/osquery/osqueryi

```

--------------------------------

### Run Example Extension

Source: https://osquery.readthedocs.io/en/stable/development/osquery-sdk

Inspect the command-line flags for the example extension and then execute it in the background, specifying the socket path for communication with the osquery shell.

```bash
$ ./build/darwin/osquery/example_extension.ext --help
osquery 1.7.0, your OS as a high-performance relational database
Usage: example_extension.ext [OPTION]...

osquery extension command line flags:

    --interval VALUE  Seconds delay between connectivity checks
    --socket VALUE    Path to the extensions UNIX domain socket
    --timeout VALUE   Seconds to wait for autoloaded extensions

osquery project page <https://osquery.io>.
$ ./build/darwin/osquery/example_extension.ext --socket /Users/USERNAME/.osquery/shell.em &

```

--------------------------------

### Basic C++ osquery Extension Example

Source: https://osquery.readthedocs.io/en/stable/development/osquery-sdk

This example demonstrates how to create a basic osquery extension in C++. It includes defining a virtual table plugin and starting the extension process. Ensure you include the necessary SDK headers and link against required libraries like boost, thrift, glog, and gflags.

```cpp
// Note 1: Include the SDK and helpers
#include <osquery/core/system.h>
#include <osquery/sdk/sdk.h>
#include <osquery/sql/dynamic_table_row.h>

using namespace osquery;

// Note 2: Define at least one plugin or table.
class ExampleTablePlugin : public TablePlugin {
 private:
  TableColumns columns() const override {
    return {
      std::make_tuple("example_text", TEXT_TYPE, ColumnOptions::DEFAULT),
      std::make_tuple("example_integer", INTEGER_TYPE, ColumnOptions::DEFAULT),
    };
  }

  TableRows generate(QueryContext& request) {
    TableRows results;

    auto r = make_table_row();
    r["example_text"] = "example";
    r["example_integer"] = INTEGER(1);

    results.push_back(std::move(r));
    return results;
  }
};

// Note 3: Use REGISTER_EXTERNAL to define your plugin or table.
REGISTER_EXTERNAL(ExampleTablePlugin, "table", "example");

int main(int argc, char* argv[]) {
  // Note 4: Start logging, threads, etc.
  osquery::Initializer runner(argc, argv, ToolType::EXTENSION);

  // Note 5: Connect to osqueryi or osqueryd.
  auto status = startExtension("example", "0.0.1");
  if (!status.ok()) {
    LOG(ERROR) << status.getMessage();
    runner.requestShutdown(status.getCode());
  }

  // Finally wait for a signal / interrupt to shutdown.
  runner.waitForShutdown();
  return runner.shutdown(0);
}

```

--------------------------------

### Start osquery Daemon using osqueryctl

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

Use this helper script to start the osquery daemon and set up the necessary configuration and launch daemon.

```bash
sudo osqueryctl start

```

--------------------------------

### Query Example Table After Loading Extension

Source: https://osquery.readthedocs.io/en/stable/development/osquery-sdk

Resume the suspended osquery shell and query the 'example' table provided by the loaded extension.

```bash
[2] 98795
$ fg
[1]  - 98777 continued  ./build/darwin/osquery/osqueryi
osquery> SELECT * FROM example;
+--------------+-----------------+
| example_text | example_integer |
+--------------+-----------------+
| example      | 1               |
+--------------+-----------------+
osquery>

```

--------------------------------

### Start osqueryd Service on Windows

Source: https://osquery.readthedocs.io/en/stable/installation/install-windows

Use these commands to start the osqueryd service depending on your shell. Ensure the configuration file is in place before starting.

```powershell
Start-Service osqueryd
```

```cmd
sc.exe start osqueryd
```

--------------------------------

### Install prerequisites for RPM builds

Source: https://osquery.readthedocs.io/en/stable/development/building

Install necessary packages, binutils and elfutils, which are prerequisites for building RPM packages on Debian-based systems.

```bash
sudo apt install binutils elfutils

```

--------------------------------

### Install osqueryd Service with manage-osqueryd.ps1

Source: https://osquery.readthedocs.io/en/stable/installation/install-windows

Use the provided PowerShell script to install osqueryd as a Windows service. Specify the startup arguments, including the path to the flag file, using the -startupArgs parameter.

```powershell
C:\Program Files\osquery
λ  .\manage-osqueryd.ps1 -install -startupArgs "--flagfile=`"C:\Program Files\osquery\osquery.flags`""
```

--------------------------------

### Chef macOS osquery Deployment Recipe

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Installs and configures the osquery agent on macOS using Chef. It sets up necessary directories, manages the LaunchDaemon plist, system logs, and configuration files, then enables and starts the osquery service.

```ruby
# Domain used by the macOS LaunchDaemon.
domain = 'io.osquery.agent'
config_path = '/var/osquery/osquery.conf'
pid_path = '/var/osquery/osquery.pid'
flagfile = '/var/osquery/osquery.flags'

directory '/var/osquery' do
  recursive true
  mode 0755
end

template "/Library/LaunchDaemons/#{domain}.plist" do
  source 'launchd.plist.erb'
  mode '0444'
  owner 'root'
  group 'wheel'
  variables(domain: domain,
            config_path: config_path,
            pid_path: pid_path,
            flagfile: flagfile
           )
  notifies :restart, "service[#{domain}]"
end

cookbook_file "/etc/newsyslog.d/#{domain}.conf" do
  source "#{domain}.conf"
  mode 0644
  owner 'root'
  group 'wheel'
end

['osquery.flags', 'osquery.conf'].each do |file|
  cookbook_file "/var/osquery/#{file}" do
    source file
    mode 0444
    owner 'root'
    group 'wheel'
    notifies :restart, "service[#{domain}]"
  end
end

service domain do
  action [:enable, :start]
end

```

--------------------------------

### Osquery Publisher Setup and Subscription

Source: https://osquery.readthedocs.io/en/stable/development/pubsub-framework

Illustrates the basic flow for setting up an osquery event publisher and how subscribers add their subscriptions. The publisher then iterates through subscriptions to fire events.

```cpp
publisher.setUp()
for sub in subscribers:
  publisher.addSubscription(sub)
publisher.configure()
Thread(target=publisher.run).start()
```

--------------------------------

### Example extensions.load File

Source: https://osquery.readthedocs.io/en/stable/deployment/extensions

A simple `extensions.load` file containing a single extension path. osquery checks for `.ext` file extensions and safe permissions.

```bash
$ cat /etc/osquery/extensions.load
/usr/lib/osquery/extensions/fb_osquery.ext
$ file /usr/lib/osquery/extensions/fb_osquery.ext
/usr/lib/osquery/extensions/fb_osquery.ext: ELF 64-bit LSB executable

```

--------------------------------

### Autoload Example Extension in Osqueryi

Source: https://osquery.readthedocs.io/en/stable/development/osquery-sdk

A simpler method to manually load an extension directly from the osqueryi command line using the --extension flag.

```bash
./build/darwin/osquery/osqueryi --extension ./build/darwin/osquery/example_extension.ext

```

--------------------------------

### Download and Install osquery Toolchain and CMake on Linux

Source: https://osquery.readthedocs.io/en/stable/development/building

Downloads and installs the osquery toolchain and a newer version of CMake. Ensures the new CMake is prioritized in the PATH.

```bash
# Download and install the osquery toolchain
export ARCH=$(uname -m) # There is toolchain support for x86_64 and aarch64.
wget https://github.com/osquery/osquery-toolchain/releases/download/1.1.0/osquery-toolchain-1.1.0-${ARCH}.tar.xz
sudo tar xvf osquery-toolchain-1.1.0-${ARCH}.tar.xz -C /usr/local

# Download and install a newer CMake.
# Afterward, verify that `/usr/local/bin` is in the `PATH` and comes before `/usr/bin`.
wget https://cmake.org/files/v3.21/cmake-3.21.4-linux-${ARCH}.tar.gz
sudo tar xvf cmake-3.21.4-linux-${ARCH}.tar.gz -C /usr/local --strip 1
```

--------------------------------

### Log aggregation example

Source: https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection

This is an example of a log line that might be received in a datastore (e.g., Elasticsearch, Splunk) when using osquery's log aggregation capabilities. It shows details of a 'startup_items' addition.

```json
{
    "name": "startup_items",
    "action":  "added",
    "columns": {
      "name":  "Phone.app",
      "path":  "/Applications/Phone.app"
    },
    "hostname":  "ted-osx.local",
    "calendarTime":  "Fri Nov  7 09:42:42 2014",
    "unixTime":  "1415382685",
    "epoch": "314159265",
    "counter": "1"
}

```

--------------------------------

### Chef Linux osquery Deployment Recipe

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Installs and configures the osquery agent on Linux using Chef. It manages the osquery configuration file and ensures the osqueryd service is enabled and started.

```ruby
# Service name installed by the osquery package.
service_name = 'osqueryd'

cookbook_file '/etc/osquery/osquery.conf' do
  source 'osquery.conf'
  mode 0444
  owner 'root'
  group 'wheel'
  notifies :restart, "service[#{service_name}]"
end

service service_name do
  action [:enable, :start]
end

```

--------------------------------

### Start Test HTTP Server (Help)

Source: https://osquery.readthedocs.io/en/stable/deployment/remote

Displays the usage information for the test HTTP server script, outlining available command-line arguments for TLS, persistence, timeouts, certificates, and enrollment secrets.

```bash
$ ./tools/tests/test_http_server.py -h
usage: test_http_server.py [-h] [--tls] [--persist] [--timeout TIMEOUT]
                          [--cert CERT_FILE] [--key PRIVATE_KEY_FILE]
                          [--ca CA_FILE] [--use_enroll_secret]
                          [--enroll_secret SECRET_FILE]
                          PORT

osquery python https server for client TLS testing.

positional arguments:
  PORT                  Bind to which local TCP port.

optional arguments:
  -h, --help            show this help message and exit
  --tls                 Wrap the HTTP server socket in TLS.
  --persist             Wrap the HTTP server socket in TLS.
  --timeout TIMEOUT     If not persisting, exit after a number of seconds
  --cert CERT_FILE      TLS server cert.
  --key PRIVATE_KEY_FILE
                        TLS server cert private key.
  --ca CA_FILE          TLS server CA list for client-auth.
  --use_enroll_secret   Require an enrollment secret for node enrollment
  --enroll_secret SECRET_FILE
                        File containing enrollment secret

```

--------------------------------

### Install macOS Prerequisites for osquery

Source: https://osquery.readthedocs.io/en/stable/development/building

Installs necessary build tools on macOS using Homebrew and pip. Includes a note about potential Xcode version conflicts.

```bash
# Install prerequisites
xcode-select --install
brew install ccache git git-lfs cmake python clang-format flex bison

# Optional: install python tests prerequisites
pip3 install --user setuptools pexpect==3.3 psutil timeout_decorator six thrift==0.11.0 osquery
```

--------------------------------

### Install Linux Prerequisites for osquery

Source: https://osquery.readthedocs.io/en/stable/development/building

Installs essential packages for building osquery on Ubuntu 18. Includes optional packages for Python tests and RPM packaging.

```bash
# Install the prerequisites
sudo apt install --no-install-recommends git python3 bison flex make

# Optional: install python tests prerequisites
sudo apt install --no-install-recommends python3-pip python3-setuptools python3-psutil python3-six python3-wheel
pip3 install timeout_decorator thrift==0.11.0 osquery pexpect==3.3

# Optional: install RPM packaging prerequisites
sudo apt install --no-install-recommends rpm binutils
```

--------------------------------

### Event Log Format - Added Process

Source: https://osquery.readthedocs.io/en/stable/deployment/logging

Example of an 'added' event log entry for the processes table, indicating a new process has started. This format is suitable for log aggregation systems.

```json
{
  "action": "added",
  "columns": {
    "name": "osqueryd",
    "path": "/opt/osquery/bin/osqueryd",
    "pid": "97830"
  },
  "name": "processes",
  "hostname": "hostname.local",
  "calendarTime": "Tue Sep 30 17:37:30 2014",
  "unixTime": "1412123850",
  "epoch": "314159265",
  "counter": "1",
  "numerics": false
}

```

--------------------------------

### Example Log Output with Decorations

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Illustrates the structure of a log line enriched with decorator data, where decorations are a top-level key.

```json
{"decorations": {"user": "you", "uptime": "10000", "version": "1.7.3"}}
```

--------------------------------

### Example osquery Configuration

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

This JSON configuration defines osqueryd options and a query schedule. Use this to set host identification, schedule query intervals, and define the queries to be executed.

```json
{
  "options": {
    "host_identifier": "hostname",
    "schedule_splay_percent": 10
  },
  "schedule": {
    "macos_kextstat": {
      "query": "SELECT * FROM kernel_extensions;",
      "interval": 10
    },
    "foobar": {
      "query": "SELECT foo, bar, pid FROM foobar_table;",
      "interval": 600
    }
  }
}

```

--------------------------------

### Implement a Time Example Table

Source: https://osquery.readthedocs.io/en/stable/development/creating-tables

This C++ code generates a table that provides the current hour, minute, and second. It includes necessary headers and uses the osquery table API.

```cpp
/**
 * Copyright (c) 2014-present, The osquery authors
 *
 * This source code is licensed as defined by the LICENSE file found in the
 * root directory of this source tree.
 *
 * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
 */

#include <ctime>
#include <osquery/core/tables.h>

namespace osquery {
namespace tables {

QueryData genTimeExample(QueryContext &context) {
  QueryData rows;

  Row r;

  time_t _time = time(0);
  struct tm* now = localtime(&_time);

  r["hour"] = now->tm_hour;
  r["minutes"] = now->tm_min;
  r["seconds"] = now->tm_sec;

  rows.push_back(std::move(r));
  return rows;
}
} // namespace tables
} // namespace osquery

```

--------------------------------

### osqueryctl Start and Config Check

Source: https://osquery.readthedocs.io/en/stable/deployment/debugging

Demonstrates a common scenario where 'osqueryctl config-check' fails if a daemon is already running and using the database path. The second check after stopping the daemon should succeed.

```shell
$ sudo osqueryctl start
$ sudo osqueryctl config-check
E0118 17:10:09.520731 1913696256 init.cpp:421] [Ref #1629] osqueryd initialize failed: Could not open RocksDB
$ sudo osqueryctl status
io.osquery.agent is running. pid: 81943
$ sudo osqueryctl stop
$ sudo osqueryctl config-check || echo 'config has an error'

```

--------------------------------

### macOS audit_control configuration example

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

This is an example configuration for the /etc/security/audit_control file on macOS. Key flags like `ex`, `pc`, `argv`, and `arge` control the types of events logged.

```text
ex:pc:argv:arge
```

--------------------------------

### Query Custom Views

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Example of querying a custom view defined in the osquery configuration.

```sql
SELECT * FROM kernel_hashes WHERE kernel_binary NOT LIKE "%apple%";

```

--------------------------------

### Install osquery Dependencies with Pip

Source: https://osquery.readthedocs.io/en/stable/development/building

Installs necessary Python packages for osquery development using pip. It's recommended to use an Administrator shell for this process.

```powershell
& 'C:\Program Files\Python37\python.exe' -m pip install setuptools psutil timeout_decorator thrift==0.11.0 osquery pywin32
```

--------------------------------

### Start Standalone osqueryi Shell

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

Command to launch the interactive osquery shell. This does not require a server or service and includes all table implementations.

```bash
osqueryi

```

--------------------------------

### Generate package data using CMake install target

Source: https://osquery.readthedocs.io/en/stable/development/building

Generate package data by building osquery and running the 'install' target. Set the DESTDIR environment variable to specify the destination folder for the package data.

```bash
cd build_folder
mkdir package_data
export DESTDIR=$(pwd)/package_data  # on Windows: `set DESTDIR=path` or `$Env:DESTDIR=path` for PowerShell
cmake --build . --target install    # on Windows: add --config Release

```

--------------------------------

### osquery SQL VERSION_ARCH Collation Example

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Compares version strings with architecture components using the VERSION_ARCH collation. Ensure the '.mode line' command is set for output.

```sql
osquery> .mode line
osquery> SELECT '4:2' = '4:2-1' COLLATE VERSION_ARCH; '4:2' = '4:2-1' COLLATE VERSION_ARCH = 1
osquery> SELECT '2-2pre' < '2-2rc' COLLATE VERSION_ARCH; '2-2pre' < '2-2rc' COLLATE VERSION_ARCH = 1
osquery> SELECT '42.2-1' > '42.1-2' COLLATE VERSION_ARCH; '42.2-1' > '42.1-2' COLLATE VERSION_ARCH = 1
```

--------------------------------

### osquery SQL VERSION_DPKG Collation Example

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Compares Debian package version strings using the VERSION_DPKG collation. Ensure the '.mode line' command is set for output.

```sql
osquery> .mode line
osquery> SELECT '1:2.0-10' = '1:2.0-10' COLLATE VERSION_DPKG; '1:2.0-10' = '1:2.0-10' COLLATE VERSION_DPKG = 1
osquery> SELECT '22.07.5-2ubuntu1.3' < '22.07.5-2ubuntu1.4' COLLATE VERSION_DPKG; '22.07.5-2ubuntu1.3' < '22.07.5-2ubuntu1.4' COLLATE VERSION_DPKG = 1
osquery> SELECT '2:8.2.3995-1ubuntu2.9' > '2:8.2.3995-1ubuntu2.3' COLLATE VERSION_DPKG; '2:8.2.3995-1ubuntu2.9' > '2:8.2.3995-1ubuntu2.3' COLLATE VERSION_DPKG = 1
```

--------------------------------

### Start Test HTTP Server (TLS)

Source: https://osquery.readthedocs.io/en/stable/deployment/remote

Launches a TLS-enabled, persistent HTTP server on port 8080. It requires specific server certificates, a CA certificate, and uses an enrollment secret from a file for node enrollment.

```bash
$ ./tools/tests/test_http_server.py --tls --persist --cert ./tools/tests/configs/test_server.pem --key ./tools/tests/configs/test_server.key --ca .tools/tests/configs/test_server_ca.pem --use_enroll_secret --enroll_secret ./tools/tests/test_enroll_secret.txt 8080
-- [DEBUG] Starting TLS/HTTPS server on TCP port: 8080

```

--------------------------------

### osquery SQL VERSION Collation Example

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Compares version strings using the VERSION collation. Ensure the '.mode line' command is set for output.

```sql
osquery> .mode line
osquery> SELECT '1.0' = '1.0' COLLATE VERSION; '1.0' = '1.0' COLLATE VERSION = 1
osquery> SELECT '50.4.1b' < '50.4.1c' COLLATE VERSION; '50.4.1b' < '50.4.1c' COLLATE VERSION = 1
osquery> SELECT '20.10a' > '20.102' COLLATE VERSION; '20.10a' > '20.102' COLLATE VERSION = 1
```

--------------------------------

### Pack Discovery Queries Example

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Defines discovery queries for a pack. The pack will only execute if all queries in the 'discovery' list return at least one row. This allows for conditional pack execution based on host state.

```json
{
  "discovery": [
    "SELECT pid FROM processes WHERE name = 'foobar';",
    "SELECT 1 FROM users WHERE username like 'www%';"
  ],
  "queries": {}
}
```

--------------------------------

### Sample Socket Event Log Entry

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

This is an example of a log entry generated by the socket_events table, showing details of a network connection.

```json
{
  "action": "added",
  "columns": {
    "time": "1527895541",
    "status": "succeeded",
    "remote_port": "80",
    "action": "connect",
    "auid": "1000",
    "family": "2",
    "local_address": "",
    "local_port": "0",
    "path": "/usr/bin/curl",
    "pid": "30220",
    "remote_address": "172.217.164.110"
  },
  "unixTime": 1527895545,
  "hostIdentifier": "vagrant",
  "name": "socket_events",
  "numerics": false
}

```

--------------------------------

### Example query for continuous monitoring

Source: https://osquery.readthedocs.io/en/stable/deployment/logging

This query, when used with 'removed: false' in the schedule, creates continuous logs of added and removed events for performance monitoring.

```sql
SELECT i.*, p.resident_size, p.user_time, p.system_time, t.minutes AS c
  FROM osquery_info i, processes p, time t
  WHERE p.pid = i.pid;

```

--------------------------------

### osquery SQL VERSION_RHEL Collation Example

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Compares Red Hat Package Manager version strings using the VERSION_RHEL collation. Ensure the '.mode line' command is set for output.

```sql
osquery> .mode line
osquery> SELECT '0.5.0~rc1^202' = '0.5.0~rc1^202' COLLATE VERSION_RHEL; '0.5.0~rc1^202' = '0.5.0~rc1^202' COLLATE VERSION_RHEL = 1
osquery> SELECT '1.1.0~BETA2' < '1.1.0~CR1' COLLATE VERSION_RHEL; '1.1.0~BETA2' < '1.1.0~CR1' COLLATE VERSION_RHEL = 1
osquery> SELECT '1.0.0' > '1.0.0~rc2' COLLATE VERSION_RHEL; '1.0.0' > '1.0.0~rc2' COLLATE VERSION_RHEL = 1
```

--------------------------------

### Create osqueryd Service with sc.exe

Source: https://osquery.readthedocs.io/en/stable/installation/install-windows

Use the Windows service utility sc.exe to create the osqueryd service. Specify the service type, start options, error handling, binary path, and display name.

```bash
C:\Users\Thor\work\repos\osquery [master ≡]
λ  sc.exe create osqueryd type= own start= auto error= normal binpath= "`"C:\Program Files\osquery\osqueryd\osqueryd.exe`" --flagfile=`"C:\Program Files\osquery\osquery.flags`"" displayname= 'osqueryd'
```

--------------------------------

### Initiate File Carving with SQL Query

Source: https://osquery.readthedocs.io/en/stable/deployment/file-carving

Use this SQL query to start a file carve operation. Specify the file path using a LIKE clause and set `carve=1` to initiate the process.

```sql
SELECT * FROM carves WHERE path LIKE '/tmp/files/%%' AND carve=1;

```

--------------------------------

### Batch Log Format Example

Source: https://osquery.readthedocs.io/en/stable/deployment/logging

This JSON structure demonstrates the batch log format, which consolidates multiple state changes into a single log line. It is enabled by launching osqueryd with `--logger_event_type=false` and is suitable for programmatic parsing into datastores.

```json
{
  "diffResults": {
    "added": [
      {
        "name": "osqueryd",
        "path": "/opt/osquery/bin/osqueryd",
        "pid": "97830"
      }
    ],
    "removed": [
      {
        "name": "osqueryd",
        "path": "/opt/osquery/bin/osqueryd",
        "pid": "97650"
      }
    ]
  },
  "name": "processes",
  "hostname": "hostname.local",
  "calendarTime": "Tue Sep 30 17:37:30 2014",
  "unixTime": "1412123850",
  "epoch": "314159265",
  "counter": "1",
  "numerics": false
}

```

--------------------------------

### Query Most Recently Started Process

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Select the process that most recently started by ordering processes by start time in descending order and limiting the result to one.

```sql
osquery> SELECT pid, name, path FROM processes ORDER BY start_time DESC LIMIT 1;
```

--------------------------------

### Remove osquery Installer Files and Directories

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

Remove the files and directories created by the osquery installer package.

```bash
sudo rm -rf /private/var/log/osquery
sudo rm -rf /private/var/osquery
sudo rm /usr/local/bin/osquery*
sudo rm -rf /opt/osquery

```

--------------------------------

### Install vagrant-aws plugin

Source: https://osquery.readthedocs.io/en/stable/development/building

Install the vagrant-aws plugin to enable AWS EC2-backed Vagrant targets. This is a prerequisite for using Vagrant with AWS.

```bash
vagrant plugin install vagrant-aws

```

--------------------------------

### Query osquery startup items

Source: https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection

Use osqueryi to query the 'startup_items' table to view applications that run at boot. This helps establish a baseline of normal system behavior.

```sql
SELECT * FROM startup_items;
```

--------------------------------

### Filesystem Config Plugin Implementation

Source: https://osquery.readthedocs.io/en/stable/development/config-plugins

This C++ code demonstrates the implementation of the default filesystem config plugin for osquery. It reads configuration from a specified file path. Ensure the config file exists and is accessible.

```cpp
// Note 1: REQUIRED includes
#include <osquery/config/config.h>
#include <osquery/core/flags.h>

namespace osquery {

// Note 2: Setup any invocation arguments
FLAG(string, config_path, "osquery.conf", "Path to config");

// Note 3: Inherit from ConfigPlugin
class FilesystemConfigPlugin : public ConfigPlugin {
 public:
  osquery::Status genConfig(std::map<std::string, std::string>& config) {
    std::string content;
    std::ifstream content_stream(FLAGS_config_path);

    content_stream.seekg(0, std::ios::end);
    content.reserve(config_stream.tellg());
    content_stream.seekg(0, std::ios::beg);

    content.assign((std::istreambuf_iterator<char>(content_stream)),
                    std::istreambuf_iterator<char>());

    // Note 4: Return an osquery Status and JSON encoded config.
    config["default_source"] = std::move(content);
    return Status(0, "OK");
  }
};

// Note 5: Register the plugin
REGISTER(FilesystemConfigPlugin, "config", "filesystem");
}

```

--------------------------------

### Join osquery Info with Processes

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Demonstrates joining the 'osquery_info' table with the 'processes' table on the PID to find the process name and path corresponding to the osquery instance.

```sql
osquery> SELECT pid, name, path FROM osquery_info JOIN processes USING (pid);
  pid = 15982
 name = osqueryi
 path = /usr/local/bin/osqueryi
```

--------------------------------

### Example PPPC Payload for osqueryd FDA

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

An example configuration profile (PPPC payload) to automatically grant Full Disk Access permissions to osqueryd on macOS hosts enrolled in MDM. Ensure 'PayloadOrganization' and 'CodeRequirement' are correctly set.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
 <key>PayloadContent</key>
 <array>
  <dict>
   <key>PayloadDescription</key>
   <string>osqueryd</string>
   <key>PayloadDisplayName</key>
   <string>osqueryd</string>
   <key>PayloadIdentifier</key>
   <string>BDBD19F2-A35A-4AEC-9E96-3CA7E2994666</string>
   <key>PayloadOrganization</key>
   <string>Trail of Bits</string>
   <key>PayloadType</key>
   <string>com.apple.TCC.configuration-profile-policy</string>
   <key>PayloadUUID</key>
   <string>89121197-3B5F-4502-BB8C-4331261D3B8C</string>
   <key>PayloadVersion</key>
   <integer>1</integer>
   <key>Services</key>
   <dict>
    <key>SystemPolicyAllFiles</key>
    <array>
     <dict>
      <key>Allowed</key>
      <true/>
      <key>CodeRequirement</key>
      <string>identifier "io.osquery.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "3522FA9PXF"</string>
      <key>Comment</key>
      <string></string>
      <key>Identifier</key>
      <string>io.osquery.agent</string>
      <key>IdentifierType</key>
      <string>bundleID</string>
     </dict>
    </array>
   </dict>
  </dict>
 </array>
 <key>PayloadDescription</key>
 <string>osqueryd</string>
 <key>PayloadDisplayName</key>
 <string>osqueryd</string>
 <key>PayloadIdentifier</key>
 <string>BDBD19F2-A35A-4AEC-9E96-3CA7E2994666</string>
 <key>PayloadOrganization</key>
 <string>Trail of Bits</string>
 <key>PayloadScope</key>
 <string>System</string>
 <key>PayloadType</key>
 <string>Configuration</string>
 <key>PayloadUUID</key>
 <string>28A8A2B7-A91E-4C26-BAEC-00F6F542742E</string>
 <key>PayloadVersion</key>
 <integer>1</integer>
</dict>
</plist>

```

--------------------------------

### List All Tables in osqueryi

Source: https://osquery.readthedocs.io/en/stable/introduction/using-osqueryi

Use the `.tables` meta-command to display a list of all available tables in the osquery schema.

```bash
osquery> .tables
  => alf_services
  => apps
  => ca_certs
  => etc_hosts
  => interface_addresses
  => interface_details
  => kernel_extensions
  => launchd
  => listening_ports
  => nvram
  => processes
  => routes
[...]
```

--------------------------------

### Build Windows osquery Packages

Source: https://osquery.readthedocs.io/en/stable/development/building

Use this command to build Windows packages (WIX or NuGet). Ensure the Visual Studio environment is set up correctly. The NuGet and WIX generators only support the a.b.c version format.

```bash
call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvars64.bat"

cmake -DCMAKE_BUILD_TYPE=Release ^
  -DCPACK_GENERATOR=WIX ^
  -DOSQUERY_PACKAGE_VERSION=%OSQUERY_VERSION% ^
  -DOSQUERY_DATA_PATH=%DESTDIR% ^
  -DOSQUERY_BITNESS=64 ^
  ..\osquery-packaging

cmake --build . --config Release --target package

```

--------------------------------

### Forget osquery Package ID

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

Inform the macOS package management system to forget about the osquery installation.

```bash
sudo pkgutil --forget io.osquery.agent

```

--------------------------------

### Distributed Write Request on macOS Host

Source: https://osquery.readthedocs.io/en/stable/deployment/remote

Example of a distributed write request on a macOS host, corresponding to the read response with discovery queries.

```json
{
  "node_key": "...",
  "queries": {
    "always_execute": [
      {"version": "5.4.0"}
    ],
    "darwin_time": [
      {"day": "17"}
    ]
  },
  "statuses": {
    "always_execute": 0,
    "darwin_time": 0
  }
}

```

--------------------------------

### Distributed Write Request on Windows Host

Source: https://osquery.readthedocs.io/en/stable/deployment/remote

Example of a distributed write request on a Windows host, corresponding to the read response with discovery queries.

```json
{
  "node_key": "...",
  "queries": {
    "always_execute": [
      {"version": "5.5.1"}
    ],
    "windows_info": [
      {"name": "windows"}
    ]
  },
  "statuses": {
    "always_execute": 0,
    "windows_info": 0
  }
}

```

--------------------------------

### Launch and SSH into AWS Vagrant VM

Source: https://osquery.readthedocs.io/en/stable/development/building

Spin up an AWS-backed Vagrant virtual machine and then SSH into it. Remember to suspend or destroy the VM when finished to avoid incurring unnecessary AWS charges.

```bash
vagrant up aws-amazon2015.03 --provider=aws
vagrant ssh aws-amazon2015.03

```

--------------------------------

### Run osquery Tests on Windows (Summary Report)

Source: https://osquery.readthedocs.io/en/stable/development/building

Executes the osquery test suite and provides a summary report. Replace `<RelWithDebInfo|Release|Debug>` with your build configuration.

```powershell
cmake --build . --config <RelWithDebInfo|Release|Debug> --target run_tests
```

--------------------------------

### Read File Without Error Checking

Source: https://osquery.readthedocs.io/en/stable/development/reading-files

A simplified example of reading a file from the filesystem without explicit error checking. Requires including osquery/filesystem/filesystem.h.

```cpp
#include <iostream>
#include <string>
#include <osquery/filesystem/filesystem.h>

int main(int argc, char* argv[]) {
  std::string content;
  osquery::readFile("/foo/bar.txt", content);
  std::cout << "Contents of " << "/foo/bar.txt" << ":\n" << content;
  return 0;
}


```

--------------------------------

### Add Integration Test for Time Example Table

Source: https://osquery.readthedocs.io/en/stable/development/creating-tables

This C++ code snippet demonstrates how to add an integration test for a table named 'time_example'. It includes setting up the test environment, executing a query, and validating the returned data against specified constraints.

```cpp
/**
 * Copyright (c) 2014-present, The osquery authors
 *
 * This source code is licensed as defined by the LICENSE file found in the
 * root directory of this source tree.
 *
 * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
 */

#include <osquery/tests/integration/tables/helper.h>

#include <osquery/utils/info/platform_type.h>

namespace osquery {
namespace table_tests {

class TimeExample : public testing::Test {
  protected:
    void SetUp() override {
      setUpEnvironment();
    }
};

TEST_F(TimeExample, test_sanity) {
  QueryData data = execute_query("select * from time_example");

  ASSERT_EQ(data.size(), 1ul);

  ValidationMap row_map = {
      {"hour", IntMinMaxCheck(0, 24)},
      {"minutes", IntMinMaxCheck(0, 59)},
      {"seconds", IntMinMaxCheck(0, 59)},
  };
  validate_rows(data, row_map);
}

} // namespace table_tests
} // namespace osquery

```

--------------------------------

### Enable Socket Auditing with Osqueryi

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

This command demonstrates how to run osqueryi with the necessary flags to enable socket auditing and configure event logging.

```bash
osqueryi --audit_allow_config=true --audit_allow_sockets=true --audit_persist=true --disable_audit=false --events_expiry=1 --events_max=50000 --logger_plugin=filesystem  --disable_events=false

```

--------------------------------

### Example Log Output with Top-Level Collisions

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Shows the resulting log structure when decorator data overwrites existing top-level keys due to name collisions.

```json
{
  "name": "collision",
  "hostIdentifier": "collision",
  "calendarTime": "collision",
  "unixTime": "collision",
  "action": "added",
  "columns": {
    "cpu_brand": "Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz",
    "hostname": "osquery.example.com",
    "physical_memory": "1234567890"
  }
}
```

--------------------------------

### Osquery Configuration with External Pack Reference

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

References an external pack configuration file using a string path. The configuration plugin, like the default filesystem plugin, will load the pack from the specified location.

```json
{
  "packs": {
    "external_pack": "/path/to/external_pack.conf",
    "internal_stuff": {
      [...]
    }
  }
}
```

--------------------------------

### Osqueryi Shell Help

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Use the '.help' meta-command within the osquery shell to view available commands and their descriptions. This provides an overview of the shell's capabilities.

```bash
$ osqueryi
Using a virtual database. Need help, type '.help'
osquery> .help
Welcome to the osquery shell. Please explore your OS!
You are connected to a transient 'in-memory' virtual database.

.all [TABLE]     Select all from a table
.bail ON|OFF     Stop after hitting an error
.connect PATH    Connect to an osquery extension socket
.disconnect      Disconnect from a connected extension socket
.echo ON|OFF     Turn command echo on or off
[...]
osquery> 

```

--------------------------------

### Get Code Requirement for osqueryd

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

Use the `codesign` tool to retrieve the CodeRequirement identifier for osqueryd. This is necessary for creating PPPC payloads for silent permission granting.

```bash
> codesign  -dr - /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
Executable=/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
designated => identifier "io.osquery.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "3522FA9PXF"

```

--------------------------------

### Manually Load an Extension

Source: https://osquery.readthedocs.io/en/stable/deployment/extensions

Load an extension individually on the osquery command line using the `--extension` flag.

```bash
osqueryi --extension /path/to/your_extension.ext

```

--------------------------------

### Get CPU Counts from /sys

Source: https://osquery.readthedocs.io/en/stable/deployment/process-auditing

These paths in the /sys filesystem provide the current counts of online and possible CPUs, which are used in BPF memory usage calculations.

```bash
possible_cpu_count: /sys/devices/system/cpu/possible
```

```bash
online_cpu_count: /sys/devices/system/cpu/online
```

--------------------------------

### Dump osquery configuration

Source: https://osquery.readthedocs.io/en/stable/deployment/debugging

Use the --config_dump flag with osqueryi to print the contents of the configuration file. This is useful for verifying the configuration before loading it.

```bash
osqueryi --config_path ./build/testing/invalid_osquery.conf --config_dump
{"./build/testing/osquery.conf": /* I PUT THIS JSON ERROR HERE, NOOOOO! */
{
 "packs": {}
}


```

--------------------------------

### macOS osquery Package File Structure

Source: https://osquery.readthedocs.io/en/stable/installation/install-macos

This outlines the default directory structure created by the osquery macOS package installer. Note the updated locations for osquery 5.x.

```bash
/private/var/osquery/io.osquery.agent.plist
/private/var/osquery/osquery.example.conf
/private/var/log/osquery/
/private/var/osquery/lenses/{*}.aug
/private/var/osquery/packs/{*}.conf
/opt/osquery/lib/osquery.app
/usr/local/bin/osqueryi -> /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
/usr/local/bin/osqueryctl -> /opt/osquery/lib/osquery.app/Contents/Resources/osqueryctl

```

--------------------------------

### Version Comparison in osquery

Source: https://osquery.readthedocs.io/en/stable/introduction/sql

Compare software versions using `version_compare`, supporting semantic versioning by default or specific flavors like ARCH, DPKG, or RHEL.

```sql
osquery> .mode line
osquery> select version_compare('1.0', '1.0');
version_compare('1.0', '1.0') = 0
```

```sql
osquery> select version_compare('4:1.1.0', '4:1.1.0-3', 'ARCH');
version_compare('4:1.1.0', '4:1.1.0-3', 'ARCH') = 0
```

```sql
osquery> select version_compare('50.4.1b', '50.4.1c');
version_compare('50.4.1b', '50.4.1c') = -1
```

```sql
osquery> select version_compare('1.0.0~rc2^2021', '1.0.0', 'RHEL');
version_compare('1.0.0~rc2^2021', '1.0.0', 3) = -1
```

```sql
osquery> select version_compare('1:1.2.13-2', '4.2.1', 'ARCH');
version_compare('1:1.2.13-2', '4.2.1', 1) = 1
```

--------------------------------

### FIM Configuration with Query-Based Paths

Source: https://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring

This configuration demonstrates how to specify file paths to monitor using a query. The `path` column from the query results will be used to determine which files to monitor.

```json
{
    "file_paths_query": {
        "category_name": [
            "SELECT DISTINCT '/home/' || username || '/.gitconfig' as path FROM last WHERE username != '' AND username != 'root';"
        ]
    }
}

```

--------------------------------

### Osquery Configuration with Inline Packs

Source: https://osquery.readthedocs.io/en/stable/deployment/configuration

Defines two packs: 'internal_stuff' with discovery queries and specific platform settings, and 'testing' with a single query. Packs are top-level keys in the osquery configuration JSON.

```json
{
  "schedule": {...},
  "packs": {
    "internal_stuff": {
      "discovery": [
        "SELECT pid FROM processes WHERE name = 'ldap';"
      ],
      "platform": "linux",
      "version": "1.5.2",
      "queries": {
        "active_directory": {
          "query": "SELECT * FROM ad_config;",
          "interval": "1200",
          "description": "Check each user's active directory cached settings."
        }
      }
    },
    "testing": {
      "shard": "10",
      "queries": {
        "suid_bins": {
          "query": "SELECT * FROM suid_bins;",
          "interval": "3600"
        }
      }
    }
  }
}
```

--------------------------------

### Basic Inline YARA Rule

Source: https://osquery.readthedocs.io/en/stable/deployment/yara

Use the 'sigrule' column to specify a simple YARA rule directly in the query. This example checks for a rule that always evaluates to true.

```sql
osquery> select * from yara where path = '/etc/passwd' and sigrule = 'rule always_true { condition: true }';
```

--------------------------------

### Run osquery Tests on Linux/macOS (Summary Report)

Source: https://osquery.readthedocs.io/en/stable/development/building

Executes the osquery test suite and provides a summary report on Linux and macOS.

```bash
cmake --build . --target test
```

--------------------------------

### Configure osqueryd Query Schedule

Source: https://osquery.readthedocs.io/en/stable/introduction/using-osqueryd

Define a schedule for osqueryd to run queries at specified intervals. This example schedules a query for USB devices to run every 60 seconds.

```json
{
  "usb_devices": {
    "query": "SELECT vendor, model FROM usb_devices;",
    "interval": 60
  }
}
```