osquery/osquery

Performant endpoint visibility

10:03AM	\|	sudo adduser gust
10:04AM	\|	sudo visudo

Build	\|	17A362
Version	\|	10.1.13
Patch	\|	6

origin	\|	Ethiopia
variety	\|	yergachiffe

address	\|	127.0.0.1
hostnames	\|	localhost

10:03AM	\|	sudo adduser gust
10:04AM	\|	sudo visudo

Build	\|	17A362
Version	\|	10.1.13
Patch	\|	6

origin	\|	Ethiopia
variety	\|	yergachiffe

address	\|	127.0.0.1
hostnames	\|	localhost

10:03AM	\|	sudo adduser gust
10:04AM	\|	sudo visudo

Build	\|	17A362
Version	\|	10.1.13
Patch	\|	6

origin	\|	Ethiopia
variety	\|	yergachiffe

address	\|	127.0.0.1
hostnames	\|	localhost

Query your devices like a database

Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery> SELECT name, path, pid FROM processes WHERE on_disk = 0;name = Drop_Agentpath = /Users/jim/bin/dropagepid = 561

Processes running without a binary on disk

Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

See Available Tables

Three things you should know about osquery

It's fast and tested

Our build infrastructure ensures that newly introduced code is benchmarked and tested. We perform continuous testing for memory leaks, thread safety, and binary reproducibility on all supported platforms.

View the Code

It runs everywhere

Windows, macOS, CentOS, and almost every Linux OS released since 2011 are supported with no dependencies. osquery powers some of the most demanding companies, including Facebook.

Download Osquery

It's open source

Osquery is released under the Apache License. Ever since we open-sourced it in 2014, organizations and individuals have contributed an ever-growing list of impressive features, useful tools, and helpful documentation.

Read Community Articles

Upcoming Community Events

See events related to Osquery that are being held in the near future.

Events are listed in reverse chronological order by date

Featured Community Projects

A curated list of community projects to help you use and extend osquery.

fleetdm / fleet

4691

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)

View on GitHub

palantir / osquery-configuration

843

A repository for using osquery for incident detection and response

View on GitHub

teoseller / osquery-attck

790

Mapping the MITRE ATT&CK Matrix with Osquery

View on GitHub

zentralopensource / zentral

783

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

View on GitHub

kolide / launcher

520

Osquery launcher, autoupdater, and packager

View on GitHub

jmpsec / osctrl

433

Fast and efficient osquery management

View on GitHub

osquery / osquery-go

407

Go bindings for osquery