osquery
Operating system instrumentation framework that exposes low-level system telemetry as SQL tables for security monitoring.
Technical Architecture & Overview
osquery is an open-source endpoint telemetry framework originally developed by Facebook (Meta). It exposes operating system data as SQL tables, allowing security teams to query running processes, network connections, file hashes, and system configurations using standard SQL syntax.
Targeted Technical Use Cases
SQL-based endpoint telemetry collection, threat hunting, and compliance auditing across fleet endpoints.
Evaluation & Trade-offs
Core Strengths
- +SQL-based queries explore operating system data such as users, processes, and listening ports.
- +Cross-platform support for Linux, macOS, and Windows from a single agent.
- +Fleet management projects such as Fleet and Zentral build on osquery.
Trade-Offs & Limitations
- -Most tables are generated at query time; continuous event auditing must be enabled per source and can affect host performance.
- -Fleet-wide distributed queries require a separate server that implements the remote settings API, such as Fleet or Zentral.
Defensive Security Application
Fleet-wide endpoint visibility, threat hunting, and configuration compliance auditing via SQL queries.
Frequently Asked Questions
What is osquery?→
osquery is an open-source endpoint telemetry framework originally developed by Facebook (Meta). It exposes operating system data as SQL tables, allowing security teams to query running processes, network connections, file hashes, and system configurations using standard SQL syntax.
What is osquery used for?→
SQL-based endpoint telemetry collection, threat hunting, and compliance auditing across fleet endpoints.
What are the strengths of osquery?→
- +SQL-based queries explore operating system data such as users, processes, and listening ports.
- +Cross-platform support for Linux, macOS, and Windows from a single agent.
- +Fleet management projects such as Fleet and Zentral build on osquery.
What are the limitations of osquery?→
- +Most tables are generated at query time; continuous event auditing must be enabled per source and can affect host performance.
- +Fleet-wide distributed queries require a separate server that implements the remote settings API, such as Fleet or Zentral.
How is osquery used defensively?→
Fleet-wide endpoint visibility, threat hunting, and configuration compliance auditing via SQL queries.