osquery

by osquery

23.0Kstars

2.5Kforks

661watchers

Updated about 1 month ago

About

osquery is a SQL-powered framework that exposes operating system data as a relational database for instrumentation, monitoring, and analytics.

SQL powered operating system instrumentation, monitoring, and analytics.

Primary Use Case

osquery is primarily used by security professionals and system administrators to query and monitor the state of endpoints across Linux, macOS, and Windows environments. It enables real-time intrusion detection, endpoint protection, and security automation by allowing users to write SQL queries to explore system data and automate monitoring tasks.

Key Features

Exposes operating system data as SQL tables for easy querying
Cross-platform support for Linux, macOS, and Windows
Plugin and extensions API for custom table implementations
Ad-hoc querying via osqueryi interactive shell
Scheduled queries for continuous monitoring with osqueryd
Integration with custom applications through Thrift APIs
Predefined table schemas representing processes, network, hardware, and more
Community-driven query packs and schema resources

Installation

Visit https://osquery.io/downloads to download the latest stable binaries for your platform
Follow platform-specific installation guides available in the documentation at https://osquery.readthedocs.org
Use the provided packages or binaries to install osquery on Linux, macOS, or Windows
Verify installation by running the osqueryi shell or starting the osqueryd daemon

Usage

>_ SELECT * FROM users;

Lists all users on the operating system.

>_ SELECT * FROM processes WHERE on_disk = 0;

Checks for running processes whose executable has been deleted from disk.

>_ SELECT DISTINCT processes.name, listening_ports.port, processes.pid FROM listening_ports JOIN processes USING (pid) WHERE listening_ports.address = '0.0.0.0';

Retrieves process names, ports, and PIDs for processes listening on all network interfaces.

>_ SELECT name, program || program_arguments AS executable FROM launchd WHERE (run_at_load = 1 AND keep_alive = 1) AND (program != '' OR program_arguments != '');

Finds macOS LaunchDaemons that launch executables and keep them running.

>_ SELECT address, mac, COUNT(mac) AS mac_count FROM arp_cache GROUP BY mac HAVING count(mac) > 1;

Detects ARP anomalies by identifying MAC addresses associated with multiple IP addresses.

Security Frameworks

Discovery

Collection

Defense Evasion

Execution

Persistence

Usage Insights

Leverage osquery's scheduled queries to automate continuous endpoint monitoring and anomaly detection.
Integrate osquery with SIEM platforms to enrich telemetry with detailed endpoint state data.
Use custom query packs to tailor detection capabilities to specific organizational threats and environments.
Combine osquery with threat hunting workflows to proactively discover signs of compromise.
Deploy osquery in purple team exercises to simulate attacker techniques and validate blue team detection rules.