We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
2 parents 43f5ba4 + ed6712d commit 8ff4576Copy full SHA for 8ff4576
1 file changed
README.rst
@@ -55,6 +55,24 @@ example:
55
osquery.start_extension(name="my_awesome_extension",
56
version="1.0.0",)
57
58
+To test this code start an osquery shell:
59
+
60
+.. code-block:: none
61
62
+ osqueryi --nodisable_extensions
63
+ osquery> select value from osquery_flags where name = 'extensions_socket';
64
+ +-----------------------------------+
65
+ | value |
66
67
+ | /Users/USERNAME/.osquery/shell.em |
68
69
70
+Then start the Python extension:
71
72
73
74
+ python ./my_table_plugin.py --socket /Users/USERNAME/.osquery/shell.em
75
76
This will register a table called "foobar". As you can see, the table will
77
return two rows:
78
0 commit comments