https://github.com/groob/osquery-condition
https://github.com/groob/osquery-condition
golang macadmins munki osquery
Last synced: 3 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/groob/osquery-condition
- Owner: groob
- Created: 2017-06-20T22:56:28.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2017-10-27T14:54:42.000Z (almost 8 years ago)
- Last Synced: 2025-04-13T21:11:44.514Z (6 months ago)
- Topics: golang, macadmins, munki, osquery
- Language: Go
- Size: 4.88 KB
- Stars: 17
- Watchers: 2
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
Use `osqueryd` to update the Munki `ConditionalItems.plist`.
You can run the binary as a munki preflight script.
This utility assumes osquery is already running in your environment.
# Usage
```
Usage of ./osquery-condition:
-queries string
path to line delimited query file
-socket string
path to osqueryd socket (default "/var/osquery/osquery.em")
```
Example:
```
sudo ./osquery-condition -queries ./sample_queries
sudo cat '/Library/Managed Installs/ConditionalItems.plist'
```
# Creating queries
To create queries for osqueryd to run, write them in a text file, *one line per query*.
Your queries are expected to return key/value pairs as results.
For example, `select * from system_info;` would return a list of key/values. When updating the `ConditionalItems.plist` file, all the keys will be prefixed with `osquery_`.