I'm hoping to create a custom "event" table (i.e. using https://osquery.readthedocs.io/en/stable/development/pubsub-framework rather than a traditional, on-demand generated table).
It seems like osquery-go might only support the on-demand generate table style though?
Entirely possible that this just isn't something you can do with a plugin, I couldn't find many details on the Thrift API to confirm this 🙂
I'm hoping to create a custom "event" table (i.e. using https://osquery.readthedocs.io/en/stable/development/pubsub-framework rather than a traditional, on-demand generated table).
It seems like
osquery-gomight only support the on-demand generate table style though?Entirely possible that this just isn't something you can do with a plugin, I couldn't find many details on the Thrift API to confirm this 🙂