From a21ce69b13cb5b8059f670e408051d628d46f0a3 Mon Sep 17 00:00:00 2001 From: Teddy Reed Date: Wed, 2 Dec 2015 10:09:32 -0800 Subject: [PATCH] Update README.rst --- README.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/README.rst b/README.rst index febea42..72d6726 100644 --- a/README.rst +++ b/README.rst @@ -81,6 +81,25 @@ Extensions are the core way that you can extend and customize osquery. At Facebook, we use extensions extensively to implement many plugins that take advantage of internal APIs and tools. +Execute queries in Python +------------------------- + +The same Thirft bindings can be used to create a Python client for the osqueryd or +osqueryi's extension socket. There are helper classes provided that spawn an ephemeral +osquery process for consecutive or long running client instances. + +.. code-block:: python + + import osquery + + if __name__ == "__main__": + # Spawn an osquery process using an ephemeral extension socket. + instance = osquery.SpawnInstance() + instance.open() + + # Issues queries and call osquery Thrift APIs. + instance.client.query("select timestamp from time") + Install -------