many_plugins.ext

#!/usr/bin/env python
"""This source code is licensed under the BSD-style license found in the
LICENSE file in the root directory of this source tree. An additional grant
of patent rights can be found in the PATENTS file in the same directory.
"""""

import osquery
import json

@osquery.register_plugin
class TestConfigPlugin(osquery.ConfigPlugin):
    """Example config plugin"""
    def name(self):
        return "test_config"

    def content(self):
        return [
            {
                "source_one": json.dumps({
                    "schedule": {
                        "time_1": {
                            "query": "select * from time",
                            "interval": 1,
                        },
                    },
                }),
                "source_two": json.dumps({
                    "schedule": {
                        "time_2": {
                            "query": "select * from foobar",
                            "interval": 2,
                        },
                    },
                }),
            }
        ]

@osquery.register_plugin
class TestLoggerPlugin(osquery.LoggerPlugin):
    """Example logger plugin"""
    def name(self):
        return "test_logger"

    def log_string(self, value):
        with open("/tmp/osqueryd.results.log", "a") as file_handle:
            file_handle.write(value)
        return osquery.extensions.ttypes.ExtensionStatus(code=0, message="OK")

@osquery.register_plugin
class FoobarTablePlugin(osquery.TablePlugin):
    """Example table plugin"""
    def name(self):
        return "foobar"

    def columns(self):
        return [
            osquery.TableColumn(name="foo", type=osquery.STRING),
            osquery.TableColumn(name="baz", type=osquery.STRING),
        ]

    def generate(self, context):
        query_data = []

        for _ in range(2):
            row = {}
            row["foo"] = "bar"
            row["baz"] = "baz"
            query_data.append(row)

        return query_data

if __name__ == "__main__":
    osquery.start_extension(
        name="many_plugins",
        version="1.0.0",)