osquery

import osquery import sys try: # Create an osquery client. # By default, it tries to connect to the osquery socket at /var/osquery/osquery.em # Ensure the osquery daemon is running and configured to use a socket. # If the daemon uses a non-default socket, pass the path: osquery.Client(path='/path/to/socket.em') client = osquery.Client() # Execute a simple SQL query query = "SELECT name, version FROM osquery_info;" response = client.query(query) print(f"Query: {query}") print(f"Status: {response.status}") if response.status: print(f"Results: {response.response}") else: print(f"Error: {response.error}") print("Make sure the osquery daemon is running and accessible.") except ConnectionRefusedError: print("Error: Could not connect to osquery daemon. Is it running?", file=sys.stderr) sys.exit(1) except FileNotFoundError: print("Error: Osquery socket not found. Is osquery daemon running and configured?", file=sys.stderr) sys.exit(1) except Exception as e: print(f"An unexpected error occurred: {e}", file=sys.stderr) sys.exit(1)