Index: head/sysutils/osquery/Makefile
===================================================================
--- head/sysutils/osquery/Makefile	(revision 449048)
+++ head/sysutils/osquery/Makefile	(revision 449049)
@@ -1,94 +1,95 @@
 # Created by: Ryan Steinmetz <zi@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	osquery
-PORTVERSION=	2.6.1
+PORTVERSION=	2.7.0
 CATEGORIES=	sysutils
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	SQL powered OS instrumentation, monitoring, and analytics
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	thrift>0:devel/thrift \
 		bash>0:shells/bash \
 		linenoise-ng>0:devel/linenoise-ng \
 		asio>0:net/asio \
+		rapidjson>0:devel/rapidjson \
 		${PYTHON_PKGNAMEPREFIX}Jinja2>0:devel/py-Jinja2
 LIB_DEPENDS=	libaugeas.so:textproc/augeas \
 		libboost_regex.so:devel/boost-libs \
 		libgflags.so:devel/gflags \
 		libglog.so:devel/glog \
 		libicuuc.so:devel/icu \
 		liblz4.so:archivers/liblz4 \
 		libsnappy.so:archivers/snappy \
 		librocksdb-lite.so:databases/rocksdb-lite \
 		libthrift.so:devel/thrift-cpp \
 		libcppnetlib-uri.so:devel/cpp-netlib \
 		libzstd.so:archivers/zstd
 RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
 
 USES=		cmake:outsource libtool python:build compiler:c++11-lib \
 		libarchive ssl
 USE_GNOME=	libxml2
 CONFIGURE_ENV+=	OSQUERY_BUILD_VERSION="${PORTVERSION}" HOME="${WRKDIR}" \
 		SKIP_TESTS="yes" CC="${CC}" CXX="${CXX}"
 CMAKE_ARGS+=	-DFREEBSD=awesome -DCMAKE_SYSTEM_NAME="FreeBSD"
 BLDDIR=		${WRKDIR}/.build/${PORTNAME}
 USE_RC_SUBR=	${PORTNAME}d
 USE_GITHUB=	yes
 GH_ACCOUNT=	facebook ${PORTNAME}:tp
 GH_PROJECT=	third-party:tp
 GH_SUBDIR=	third-party:tp
 GH_TAGNAME=	${PORTVERSION}:tp
 
 # Some options for things that bring in many dependencies
 OPTIONS_DEFINE=	TSK AWS YARA LLDPD
 
 TSK_DESC=		Build with sleuthkit support
 TSK_LIB_DEPENDS=	libtsk.so:sysutils/sleuthkit
 TSK_CONFIGURE_ENV_OFF=	SKIP_TSK=1
 
 AWS_DESC=		Support logging to AWS Kinesis
 AWS_LIB_DEPENDS=	libaws-cpp-sdk-core.so:devel/aws-sdk-cpp
 AWS_CONFIGURE_ENV_OFF=	SKIP_AWS=1
 
 YARA_DESC=		Build with YARA malware identification support
 YARA_LIB_DEPENDS=	libyara.so:security/yara
 YARA_CONFIGURE_ENV_OFF=	SKIP_YARA=1
 
 LLDPD_DESC=		Support Link Layer Discovery Protocol
 LLDPD_LIB_DEPENDS=	liblldpctl.so:net-mgmt/lldpd
 LLDPD_CONFIGURE_ENV_OFF=SKIP_LLDPD=1
 
 .include <bsd.port.pre.mk>
 
 .if ${OSVERSION} < 1100000
 BUILD_DEPENDS+=	clang38:devel/llvm38
 CC=	clang38
 CXX=	clang++38
 .endif
 
 post-patch:
 	${REINPLACE_CMD} -e 's|/var/osquery/|/var/db/osquery/|g' \
 		${WRKSRC}/tools/deployment/osquery.example.conf
 	${REINPLACE_CMD} -e 's|python|${PYTHON_CMD}|g' \
 		${WRKSRC}/CMakeLists.txt \
 		${WRKSRC}/tools/get_platform.py
 
 do-install:
 	${INSTALL_PROGRAM} ${BLDDIR}/osqueryi ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${BLDDIR}/osqueryd ${STAGEDIR}${PREFIX}/sbin
 	${INSTALL_DATA} ${BLDDIR}/libosquery.a ${STAGEDIR}${PREFIX}/lib
 	(cd ${WRKSRC}/include && ${COPYTREE_SHARE} ${PORTNAME} ${STAGEDIR}${PREFIX}/include)
 	${INSTALL_DATA} ${WRKSRC}/tools/deployment/osquery.example.conf \
 		${STAGEDIR}${PREFIX}/etc/osquery.conf.sample
 
 	${MKDIR} ${STAGEDIR}/var/db/osquery ${STAGEDIR}/var/log/osquery
 	# The flags file must exist, even if empty. Using @sample
 	# prevents a populated flags file from being nuked on upgrade.
 	${TOUCH} ${STAGEDIR}${PREFIX}/etc/osquery.flags.sample \
 		${STAGEDIR}${PREFIX}/etc/osquery.flags
 
 .include <bsd.port.post.mk>
Index: head/sysutils/osquery/distinfo
===================================================================
--- head/sysutils/osquery/distinfo	(revision 449048)
+++ head/sysutils/osquery/distinfo	(revision 449049)
@@ -1,5 +1,5 @@
-TIMESTAMP = 1502739110
-SHA256 (facebook-osquery-2.6.1_GH0.tar.gz) = 288e5455fedd4e7d5ea2ee123477b3f75630db14979205717268c25cbdca04fd
-SIZE (facebook-osquery-2.6.1_GH0.tar.gz) = 957008
-SHA256 (osquery-third-party-2.6.1_GH0.tar.gz) = 1c58ad711f08656184e0d5b3fa53ecf5e9fef6034143e4c41c2989b54f6d5381
-SIZE (osquery-third-party-2.6.1_GH0.tar.gz) = 3264472
+TIMESTAMP = 1504120429
+SHA256 (facebook-osquery-2.7.0_GH0.tar.gz) = ce5fb4e6000904e998ca4cc9aae2c4125505d6b11e5f0c318456ee9ded8cc2dc
+SIZE (facebook-osquery-2.7.0_GH0.tar.gz) = 973435
+SHA256 (osquery-third-party-2.7.0_GH0.tar.gz) = 264070dbe55e1cb3dd94b263b9110b863963cbde9363a08f49d7a27b2aa9e5f1
+SIZE (osquery-third-party-2.7.0_GH0.tar.gz) = 3264470
Index: head/sysutils/osquery/pkg-plist
===================================================================
--- head/sysutils/osquery/pkg-plist	(revision 449048)
+++ head/sysutils/osquery/pkg-plist	(revision 449049)
@@ -1,25 +1,26 @@
 bin/osqueryi
 @dir /var/db/osquery
 @dir /var/log/osquery
 include/osquery/config.h
 include/osquery/core.h
 include/osquery/database.h
 include/osquery/dispatcher.h
 include/osquery/distributed.h
 include/osquery/enroll.h
 include/osquery/events.h
 include/osquery/extensions.h
 include/osquery/filesystem.h
 include/osquery/flags.h
 include/osquery/logger.h
 include/osquery/packs.h
 include/osquery/registry.h
 include/osquery/sdk.h
 include/osquery/sql.h
 include/osquery/status.h
 include/osquery/system.h
 include/osquery/tables.h
+include/osquery/query.h
 lib/libosquery.a
 sbin/osqueryd
 @sample etc/osquery.conf.sample
 @sample etc/osquery.flags.sample