Thiago Teixeira
EN | PT

osquery

Linux Foundation

Expose an operating system as a high-performance relational database, queryable with SQL.

Endpoint Analysis Free & Open Source Agent / Service Learning Cross-platform
Homepage

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Detection / Monitoring
9 Containment & Eradication
10 Post-incident Forensics

Description

osquery (originally Facebook, now a Linux Foundation project) is an endpoint instrumentation framework that exposes operating system state as SQL tables. Run a query like SELECT * FROM processes WHERE on_disk=0; and you get every running process whose backing binary has been deleted — a classic IOC.

Architecture:

  • osqueryd — daemon that runs scheduled queries.
  • osqueryi — interactive REPL.
  • Fleet / Kolide / FleetDM — popular open-source management servers that distribute query packs to thousands of hosts.

Hundreds of tables cross-platform: processes, listening_ports, startup_items, users, logged_in_users, kernel_modules, deb_packages, windows_security_products, etc.

Use cases

  • Threat hunting at fleet scale with SQL
  • Compliance attestation (FIM, missing patches)
  • Cross-platform IOC sweeps

Example

-- Find processes running from temporary directories
SELECT pid, name, path FROM processes
WHERE path LIKE '%\Temp\%' OR path LIKE '/tmp/%';