{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/876","labels_url":"https://api.github.com/repos/facebook/osquery/issues/876/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/876/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/876/events","html_url":"https://github.com/facebook/osquery/issues/876","id":62793451,"number":876,"title":"python module API","user":{"login":"marpaia","id":927168,"avatar_url":"https://avatars.githubusercontent.com/u/927168?v=3","gravatar_id":"","url":"https://api.github.com/users/marpaia","html_url":"https://github.com/marpaia","followers_url":"https://api.github.com/users/marpaia/followers","following_url":"https://api.github.com/users/marpaia/following{/other_user}","gists_url":"https://api.github.com/users/marpaia/gists{/gist_id}","starred_url":"https://api.github.com/users/marpaia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marpaia/subscriptions","organizations_url":"https://api.github.com/users/marpaia/orgs","repos_url":"https://api.github.com/users/marpaia/repos","events_url":"https://api.github.com/users/marpaia/events{/privacy}","received_events_url":"https://api.github.com/users/marpaia/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/facebook/osquery/labels/RFC","name":"RFC","color":"cc317c"},{"url":"https://api.github.com/repos/facebook/osquery/labels/user%20experience","name":"user experience","color":"bfd4f2"}],"state":"open","locked":false,"assignee":{"login":"marpaia","id":927168,"avatar_url":"https://avatars.githubusercontent.com/u/927168?v=3","gravatar_id":"","url":"https://api.github.com/users/marpaia","html_url":"https://github.com/marpaia","followers_url":"https://api.github.com/users/marpaia/followers","following_url":"https://api.github.com/users/marpaia/following{/other_user}","gists_url":"https://api.github.com/users/marpaia/gists{/gist_id}","starred_url":"https://api.github.com/users/marpaia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marpaia/subscriptions","organizations_url":"https://api.github.com/users/marpaia/orgs","repos_url":"https://api.github.com/users/marpaia/repos","events_url":"https://api.github.com/users/marpaia/events{/privacy}","received_events_url":"https://api.github.com/users/marpaia/received_events","type":"User","site_admin":false},"milestone":null,"comments":12,"created_at":"2015-03-18T20:38:09Z","updated_at":"2015-04-30T01:11:54Z","closed_at":null,"body":"Please comment on ways that we can extend/improve the API for the upcoming python module. We're still working through it, but we want the API itself to be intuitive, so we're designing the API first. \r\n\r\nConsider the following \"extension\" that registers a logger plugin, a config plugin and a new table:\r\n\r\n```py\r\nimport json\r\nimport pyosquery\r\n\r\nclass RandomLoggerPlugin(pyosquery.LoggerPlugin):\r\n    def log_string(self, string):\r\n        print(\"[+] {value}\".format(value=string))\r\n\r\nclass RandomTablePlugin(pyosquery.TablePlugin):\r\n    def columns(self):\r\n        return {\r\n            {\"foo\": pyosquery.INTEGER},\r\n            {\"bar\": pyosquery.TEXT},\r\n        }\r\n\r\n    def generate(self, context):\r\n        results = []\r\n        for i in range(10):\r\n            row = {}\r\n            row[\"foo\"] = i\r\n            row[\"bar\"] = \"my number is {i}\".format(i=i)\r\n            results.append(row)\r\n        return results\r\n\r\nclass RandomConfigPlugin(pyosquery.ConfigPlugin):\r\n    def generate_config(self):\r\n        return json.dumps({\r\n            \"scheduledQueries\": [\r\n                {\r\n                    \"name\": \"example_1\",\r\n                    \"query\": \"select * from osquery_info;\",\r\n                    \"interval\": 10,\r\n                },\r\n                {\r\n                    \"name\": \"example_2\",\r\n                    \"query\": \"select * from osquery_flags;\",\r\n                    \"interval\": 20,\r\n                },\r\n            ]\r\n        })\r\n\r\nif __name__ == \"__main__\":\r\n    pyosquery.register_logger(RandomLoggerPlugin, \"foolog\")\r\n    pyosquery.register_config(RandomConfigPlugin, \"barconf\")\r\n    pyosquery.register_table(RandomTablePlugin, \"randtab\")\r\n\r\n    pyosquery.start_extension()\r\n```\r\n\r\nIn the above example, you could start osqueryd with the following flags:\r\n\r\n```\r\nosqueryd --config_plugin=foolog --config_plugin=barconf\r\n```\r\n\r\nYou could also schedule a query: \r\n```sql\r\nSELECT foo, bar FROM randtab;\r\n```\r\n\r\nAdditionally, you can execute queries:\r\n\r\n```py\r\nimport pyosquery\r\n\r\nif __name__ == \"__main__\":\r\n    conn = pyosquery.connect(path=\"/var/osquery/osquery.em\")\r\n    q = conn.query(\"select * from randtab\")\r\n    for result in q.results:\r\n        print \"foo: {foo}, bar: {bar}\".format(foo=result[\"foo\"], bar=result[\"bar\"])\r\n```"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/97624971","html_url":"https://github.com/facebook/osquery/issues/876#issuecomment-97624971","issue_url":"https://api.github.com/repos/facebook/osquery/issues/876","id":97624971,"user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"created_at":"2015-04-30T01:11:54Z","updated_at":"2015-04-30T01:11:54Z","body":"Moving development to https://github.com/osquery/osquery-python"}}