osquery: query your endpoints like a SQL database

osquery (about 24,000 stars on GitHub) is an operating system instrumentation framework that presents a computer as a relational database. It was created at Facebook in 2014 to monitor its own fleet of servers and laptops and was transferred to the Linux Foundation in 2019, where it is run by the osquery Foundation with maintainers from several companies. The code is C++ and ships as a single binary for Linux, macOS and Windows.

What it does

osquery implements hundreds of virtual tables, each backed by a system API rather than stored data: processes, listening_ports, users, logged_in_users, crontab, kernel_modules, installed package tables for each package manager, browser extensions, launch agents on macOS, services and registry keys on Windows, and many more. You query them with ordinary SQLite syntax, including joins. The interactive shell osqueryi is useful for one off investigation; the daemon osqueryd runs scheduled queries, records how results change over time and writes the differences as logs. Shipped to a central collector, those logs give a fleet wide view of configuration and activity, and they are a common input to detection rules and compliance checks.

Who it is for

• Security teams that need a uniform way to ask every machine the same question, for example whether a vulnerable package is installed anywhere.
• System administrators who want inventory and change tracking without agents from several vendors.
• Incident responders who need to inspect a live system quickly with a language they already know.
• Builders of endpoint products: several commercial and open source fleet managers such as Fleet and Kolide are built around osquery.

How to install it

The project publishes packages and installers for every supported platform, plus repositories for Debian, Ubuntu and Red Hat families. Installing the package and opening the shell is enough to start exploring:

sudo apt install osquery
osqueryi "SELECT pid, name, path FROM processes WHERE name LIKE '%ssh%';"

Running the daemon across many machines normally goes through a fleet manager, which distributes query packs and collects results. The documentation has a full table schema browser and deployment guides.

Credit

osquery was created by Facebook engineers and is maintained by the osquery Foundation under the Linux Foundation, with a technical steering committee drawn from the community. The code is dual licensed under the Apache License 2.0 and the GNU General Public License version 2, at the user’s choice.