osquery
By osquery Community (originated at Meta)
osquery is an open-source endpoint instrumentation tool that exposes operating system state, such as running processes, installed packages, open network connections, and file metadata, as queryable tables through a SQL interface. Security…
Definition
osquery is an open-source endpoint instrumentation tool that exposes operating system state, such as running processes, installed packages, open network connections, and file metadata, as queryable tables through a SQL interface. Security teams use it to run ad hoc or scheduled SQL queries across a fleet of hosts to investigate incidents, monitor for configuration drift, and detect indicators of compromise without needing custom scripts for each operating system.
Overview
Investigating an endpoint's state traditionally means running a different set of operating-system-specific commands and parsing their output by hand, which does not scale across a fleet of thousands of machines running different operating systems. osquery, originally built at Meta and later open sourced, addresses this by representing operating system internals as a set of relational tables and letting analysts query them with ordinary SQL, regardless of the underlying platform. Mechanically, an osquery agent runs on each monitored host and exposes system state, such as running processes, loaded kernel modules, listening network sockets, installed software, and user accounts, as virtual database tables that can be queried with standard SQL syntax. Queries can be run interactively for one-off investigation, scheduled to run periodically and log results centrally, or configured as continuous queries that alert when specific conditions are met, such as a new listening port appearing on a server. osquery differs from a log analysis tool like Wazuh or a network monitor like Zeek in that its focus is point-in-time and ongoing introspection of a single host's actual state, exposed through a query interface rather than a stream of log events. It is often deployed alongside a SIEM or fleet management platform such as Fleet, which handles distributing queries to thousands of osquery agents and aggregating their results centrally. This design also makes osquery well suited to answering questions nobody anticipated in advance, since an analyst can write a brand-new query on the spot rather than waiting for a vendor to ship a detection rule for that specific scenario. In practice, security teams use osquery to answer specific investigative questions quickly, such as which hosts are running a particular vulnerable software version or which processes have an unexpected outbound network connection, without writing custom collection scripts per operating system. It's also used for continuous compliance and configuration monitoring, flagging hosts that drift from an approved baseline. The trade-off is that osquery itself is just the query engine and table schema; running it at scale requires additional infrastructure such as a fleet manager to distribute queries and collect results, and building effective scheduled queries and alerting logic requires SQL fluency and an understanding of what each table actually represents. It is a toolkit for teams willing to build their own investigative and monitoring workflows rather than a turnkey detection product, and organizations that want prebuilt detection content out of the box may find a commercial EDR platform a faster path to the same visibility.
Key Features
- Exposes operating system state as queryable SQL tables
- Runs interactive, scheduled, or continuously alerting queries
- Works consistently across Windows, macOS, and Linux hosts
- Supports fleet-wide investigation without custom per-OS scripts
- Often paired with a fleet manager like Fleet for centralized control
- Enables configuration drift and compliance baseline monitoring
- Open source, originally built and released by Meta
- Provides low-level visibility into processes, sockets, and packages