foobar_config.ext

#!/usr/bin/env python
"""This source code is licensed under the BSD-style license found in the
LICENSE file in the root directory of this source tree. An additional grant
of patent rights can be found in the PATENTS file in the same directory.
"""

import osquery
import json

@osquery.register_plugin
class FoobarConfigPlugin(osquery.ConfigPlugin):
    """Example config plugin"""
    def name(self):
        return "foobar"

    def content(self):
        return [
            {
                "source_one": json.dumps({
                    "schedule": {
                        "time_1": {
                            "query": "select * from time",
                            "interval": 1,
                        },
                    },
                }),
                "source_two": json.dumps({
                    "schedule": {
                        "time_2": {
                            "query": "select * from time",
                            "interval": 2,
                        },
                    },
                }),
            }
        ]

if __name__ == "__main__":
    osquery.start_extension(
        name="foobar_config",
        version="1.0.0",)