Overview

OSQuery is an open-source endpoint monitoring and analysis tool that exposes operating system information as a relational database. Using SQL-like queries, you can explore system state for intrusion detection, troubleshooting, compliance auditing, and security monitoring. Developed and maintained by Facebook (now Meta), OSQuery runs on Linux, macOS, Windows, and FreeBSD, providing real-time visibility into running processes, file integrity, network connections, kernel modules, and hundreds of other system attributes through an interactive query console or scheduled queries.

Key Features

• SQL-Based Queries: Query system information using standard SQL syntax with hundreds of built-in tables
• Real-Time Monitoring: Track process creation, file system events, network connections, and socket activity
• Cross-Platform: Consistent interface across Linux, macOS, Windows, and FreeBSD
• Extensible: Custom tables can be written in C++ or using the osquery extension SDK
• Schedule & Deploy: Automate queries on schedules and deploy across fleets with Fleet or Kolide

Why Use It

OSQuery transforms complex system monitoring into database queries accessible to anyone with basic SQL knowledge. It provides unprecedented visibility into system internals and simplifies security auditing, incident response, and compliance verification across large numbers of endpoints.

Use Cases

• Incident response: Quickly investigate compromised systems by querying processes, connections, and file changes
• Compliance auditing: Verify system configurations against CIS benchmarks and security policies via SQL queries
• Vulnerability detection: Identify outdated software, missing patches, and misconfigured services across the fleet
• IT asset inventory: Maintain detailed hardware and software inventories across all managed endpoints

Platform

Linux, macOS, Windows, FreeBSD

Licence

Apache License 2.0

Website

osquery.io