Introducing v1.0: github.com/chainguard-dev/osqt

It's a swiss-army tool for testing, creating, and manipulating query packs.

Got a directory full of SQL files and want to archive it into a query pack?

`osqtool pack <directory>`

want to ensure that none of the queries in it will consume more than 15 minutes across a day of querying by multiplying the interval vs runtime duration?

`osqtool -max-query-daily-duration=15m verify <pack|directory>`

Go forth and enjoy!

#osquery #osqtool

Last updated 3 years ago