Search code examples
osquery

How to execute a SQL-query to osquery remotely?


I was able to find that osquery can work in interactive mode (osqueryi) and in daemon mode (osqueryd), in which it will periodically execute SQL queries in the background on a localhost. How about remote execution of SQL queries - for example, REST service or JDBC-driver?


Solution

  • When osquery is running in daemon mode, you can enable the distributed query facilities. When this is enabled, osqueryd will periodically check in to a remote server to see whether there are queries for it to execute (typical intervals for this check range from 10 seconds to 1 minute).

    Note that due to the nature of the environments that osquery runs in, the osquery agent does not listen for incoming connections. It only ever makes outgoing connections to a remote server to check for queries to execute.

    To take advantage of this, you need a server implementing the osquery remote APIs. There are a handful of open-source options available:

    Fleet (disclaimer: I build this)

    Zentral

    Doorman

    SGT

    Security note: providing remote execution on an osquery agent can be very dangerous since it can retrieve sensitive information on the device it runs on. If you plan to serve some sort of a web page allowing direct queries on your agent, be aware that since osquery provide an SQL abstraction of your system, it can be vulnerable to injections.