sidorares / osquery-node

node.js client for osquery

osquery-node

Facebook osquery client for node.js

Installation

npm install osquery

Usage

client:

var osquery = require('osquery');

var os = osquery.createClient({ path: '/var/osquery/osquery.em' });
os.query('SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid', function(err, res) {
  console.log(res);
});

Table plugin:

var osquery = require('osquery');

var generateTable = function(req, resp) {
  resp(null, [{
        "foo": "foo value",
        "bar": "bar value " + Date.now()
      }]
  );
};

var c = osquery.createClient();
var s = c.createServer({
  info: {
    name: 'test table extension'
  },
  plugins: [{
    type: 'table',
    name: 'node_ext_table',
    schema: [
      {"name": "foo", "type": "TEXT"},
      {"name": "bar", "type": "TEXT"}
    ],
    handler: generateTable
  }]
});

s.listen(function(err, serv) {
  console.log('extension started!');
});

License

MIT

See also

• mysql to osquery proxy
• python client

osquery-node's Issues

client example in readme is invalid

It has an extra "select *" in front of it.

Only TEXT (strings) are supported

When sending a response, all value types must be a string or writeString will fail:
(this is using { "foo": 2 } having changed the schema to be "INTEGER"):

Error: writeString called without a string/Buffer argument: 2
    at TBinaryProtocol.writeString (/Users/chuck/Desktop/swamp/node_modules/osquery/node_modules/thrift/lib/thrift/protocol.js:149:11)
    at Object.ExtensionResponse.write (/Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/osquery_types.js:381:20)
    at Object.Extension_call_result.write (/Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/Extension.js:251:18)
    at /Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/Extension.js:434:14
    at /Users/chuck/Desktop/swamp/node_modules/osquery/extension_server.js:42:7
    at generateTable (/Users/chuck/Desktop/swamp/osquery.js:63:3)
    at /Users/chuck/Desktop/swamp/osquery.js:17:3

windows support

Is it possible to run on windows?

Server listen does not clean up used socket path

Apparently this can lead to many "/var/osquery/osquery.em.*" files and attempts address in use errors. This may only happen if the script is terminated unexpectedly (not sure).

Connect error with /var/osquery/osquery.em file

Hello,

When I launch following code :

    let os = osquery.createClient();
    os.query('SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid', function(err, res) {
        res.json(res);
    });

It return an error :

Uncaught Error: connect ECONNREFUSED /var/osquery/osquery.em

Thanks for your help