0

i am new with Osquery. I have a virtual machine on GCP where i have developed my Web-app. I want to find out with Osquery the IP address that connects to my virtual machine/ webapp, especially the HTTP package .

Thanks!

No result founded, i have also tried to ask to ChatGPT, but it returns me non-existent columns.

Andrea
  • 1
  • 1

1 Answers1

0

This is not directly possible. Osquery has access to the local machine data, and the local machine may not know what the WAN ip is. (this is somewhat inherent in the way NAT/VPC/SDN/etc work)

However, I can think of two unvetted workarounds

First, if your VM is hosted on a provider that makes that information accessible, then osquery may be able to access it. I don't know what's available in the AWS or GCP metadata.

Second, if there is a provider that will return it, what-is-my-ip style, you can parse it with the curl table. For example, using https://www.ipify.org/ you can:

osquery> select result  from curl where url = 'https://api.ipify.org';
+-------------+
| result      |
+-------------+
| 1.2.3.4     |
+-------------+

You will need to understand licensing terms for such third parties.

seph
  • 813
  • 6
  • 16