Search code examples
osquery

I want to connect my web application to show the reports from osquery SQLITE database


Thanks a lot for such a amazing tool.

I am running osquery installed on windows machine using installer from https://osquery.io/.

I want to connect my web application to show the reports from osquery SQLITE database.

I am unable to see any SQLITE db file, could you please help or suggest how i can connect .

Note: I have installed using osquery-3.2.6.msi


Solution

  • Connecting to the osquery database locally isn't supported, as there's nothing stored in that database (Specifically C:\ProgramData\osquery\osquery.db) except differential information for differential scheduled queries. If you're looking to consume the output of osquery scheduled queries, you'll want to check where ever you've configured the logger output to go, by default this is in C:\ProgramData\osquery\log. Can you be a bit more specific about what configuration you're using?

    It's pretty common that an osquery deployment will typically have a centralized SIEM somewhere (Something like Splunk or an ELK stack), that osquery will send it's result information to, from which you can construct the graphs it sounds like you're wanting. I'd also encourage you to hop into the osquery slack where you might get more rapid responses. Hope that helps :)