#sockets #api #instance

osquery-rs

This crate allows you to execute osquery SQL queries using osquery Thrift API

2 releases

0.1.3 Dec 10, 2022
0.1.2 Jul 6, 2022

#2393 in Database interfaces

Download history 205/week @ 2024-12-04 314/week @ 2024-12-11 141/week @ 2024-12-18 4/week @ 2024-12-25 38/week @ 2025-01-01 287/week @ 2025-01-08 628/week @ 2025-01-15 613/week @ 2025-01-22 369/week @ 2025-01-29 259/week @ 2025-02-05 168/week @ 2025-02-12 346/week @ 2025-02-19 743/week @ 2025-02-26 490/week @ 2025-03-05 395/week @ 2025-03-12 595/week @ 2025-03-19

2,272 downloads per month

MIT/Apache

105KB
2.5K SLoC

osquery-rs

This crate allows you to execute osquery SQL queries using osquery Thrift API. You can execute osquery SQL query using one of the following methods:

  • Connect to the extension socket for an existing osquery instance

  • Spawn your own osquery instance and communicate with it using its extension socket

Currently this crates only works on Linux. I am still working on Windows version.

Usage

  • Add it to your dependencies

    [dependencies]
    osquery-rs = { git = "https://github.com/AbdulRhmanAlfaifi/osquery-rs"}
    
  • Start executing queries !

Examples

Connect to extension socket for an existing osquery instance

use osquery_rs::OSQuery;

fn main () {
    let res = OSQuery::new()
            .set_socket("/home/root/.osquery/shell.em")
            .query(String::from("select * from time"))
            .unwrap();
    println!("{:#?}", res);
}

Spawn your own osquery instance (standalone)

use osquery_rs::OSQuery;

fn main() {
    let res = OSQuery::new()
        // Specify the path to the osquery binary
        .spawn_instance("./osqueryd")
        .unwrap()
        .query(String::from("select * from time"))
        .unwrap();
    println!("{:#?}", res);
}

by default the socket path is /tmp/osquery-rs, you can change it by calling the function set_socket:

use osquery_rs::OSQuery;

fn main() {
    let res = OSQuery::new()
        .set_socket("/tmp/mysocket")
        // Specify the path to the osquery binary
        .spawn_instance("./osqueryd")
        .unwrap()
        .query(String::from("select * from time"))
        .unwrap();
    println!("{:#?}", res);
}

Dependencies

~0.7–1MB
~18K SLoC