Home

osquery wiki

osquery is an operating system instrumentation toolchain for *nix based hosts. osquery makes low-level operating system analytics and monitoring both performant and intuitive.

osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as

• running processes
• loaded kernel modules
• open network connections

SQL tables are implemented via an easily extendable API. A bunch of tables already exist and more are constantly being written. To best understand the expressiveness that is afforded to you by osquery, consider the following SQL queries:

--------------------------------------------------------
-- get the name, pid and attached port of all processes 
-- which are listening on all interfaces
--------------------------------------------------------
SELECT DISTINCT 
  process.name, 
  listening.port, 
  process.pid
FROM processes AS process
JOIN listening_ports AS listening
ON process.pid = listening.pid
WHERE listening.address = '0.0.0.0';

--------------------------------------------------------
-- find every launchdaemon on an OS X host which 
--   * launches an executable when the operating 
--     system starts
--   * keeps the executable running 
-- return the name of the launchdaemon and the full 
-- path (with arguments) of the executable to be ran.
--------------------------------------------------------
SELECT 
  name, 
  program || program_arguments AS executable 
FROM launchd 
WHERE 
  (run_at_load = 'true' AND keep_alive = 'true') 
AND 
  (program != '' OR program_arguments != '');

These queries can be:

• performed on an ad-hoc basis to explore operating system state
• executed via a scheduler to monitor operating system state across a distributed set of hosts over time
• launched from custom applications using osquery APIs

Features

• Distributed host monitoring daemon
• Interactive query console
• Rich APIs for easily monitoring and querying operating system data

Getting Started

Getting started with osquery is easy, regardless of if you'd like to extend osquery or use the pre-built, open source tools.

If you're interested in installing and using osquery right now, check out the install guide for OS X and Linux.

If you're interested in deploying osquery to provide your organization with deeper insight into your Linux and OS X hosts, check out the deployment guide.

If you're interested in performing ad-hoc operating system analytics, DFIR, etc. then check out the analytics guide.

If you're interested in extending one of the existing osquery products or improving core libraries, read the developer's guide.

If you're interest in using osquery's functionality in your own tool, check out the public API documentation.

Project History

Links

Contact