You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Issue - I created an osquery extension which includes a logger and a config plugin using osquery-go. Within this extension, I established a runtime config. When a scheduled query is triggered, it works fine. However, when Packs are utilized, it does not provide the expected callback.
Operating System - Windows 10 go version - go1.21.3
Output -
Only getting callback for processes. Not getting any callback for packs. For now trying with only one config. But in real scenario we can use multiple files
in this doc it say's osquery packs needs to be achieve by implementing virtual method in cpp. (Follow Additional overloads from above link)
In osquery-go it seems that only genConfig is handled genPack is not handled.
Can some one PLEASE help here?
Thanks in advance.
The text was updated successfully, but these errors were encountered:
User2798
changed the title
When schedule Osquery packs in conf format not getting callback
When schedule Osquery packs in runtime config not getting callback
Dec 16, 2023
Issue - I created an osquery extension which includes a logger and a config plugin using osquery-go. Within this extension, I established a runtime config. When a scheduled query is triggered, it works fine. However, when Packs are utilized, it does not provide the expected callback.
Operating System - Windows 10
go version - go1.21.3
Code snippet
Flages :-
Below is my runtime config :-
Below are my logger and config function.
Output -
Only getting callback for processes. Not getting any callback for packs. For now trying with only one config. But in real scenario we can use multiple files
What does windows-attacks.conf contain?
Answer - This is general pack found on https://github.com/osquery/osquery/tree/master/packs
Few other observation -
I am no expert in this. Learning Osquery.
But,
https://osquery.readthedocs.io/en/stable/development/config-plugins/
in this doc it say's osquery packs needs to be achieve by implementing virtual method in cpp. (Follow Additional overloads from above link)
In osquery-go it seems that only genConfig is handled genPack is not handled.
Can some one PLEASE help here?
Thanks in advance.
The text was updated successfully, but these errors were encountered: