osquery

osquery is an open-source endpoint visibility agent that exposes operating system state as a relational database, letting security teams query processes, files, users, and network connections using SQL.

Endpoint Visibility open-source endpoint-security threat-hunting sql

Overview

osquery is a free and open-source endpoint visibility agent originally created at Facebook and now maintained by the osquery Foundation. It converts the operating system into a high-performance relational database, exposing hundreds of virtual tables that represent processes, open sockets, logged-in users, loaded kernel modules, installed packages, file hashes, browser extensions, and more. Security teams query this data with standard SQL, either interactively through osqueryi or continuously through scheduled queries via osqueryd. Results are streamed as JSON to SIEM, log pipelines, or fleet management platforms such as Kolide, Fleet, or Elastic. osquery supports Linux, macOS, and Windows, and it is widely used for threat hunting, incident response, compliance auditing, and real-time endpoint detection engineering.

Primary Use Cases

✔ Threat hunting on live endpoints by running SQL queries against processes, network connections, users, and file hashes to uncover attacker activity.

✔ Real-time incident response by querying running processes, listening sockets, and logged-in users on a suspected compromised host.

✔ Continuous endpoint detection engineering by scheduling SQL queries with osqueryd and streaming results as JSON into SIEM platforms like Wazuh, Elastic, or Splunk.

Frequently Asked Questions

Yes. osquery is released under the Apache 2.0 license and maintained by the osquery Foundation. There are no licensing fees for the agent, and it supports Linux, macOS, and Windows.

As of September 2026, the current stable release is osquery 5.19.x, continuing the 5.x LTS line. Recent releases have focused on expanded table coverage, improved performance on Windows and macOS, and tighter integration with Fleet and Elastic.

osquery is visibility-focused rather than prevention-focused. It exposes system state for querying and detection, but does not include built-in blocking, quarantine, or remediation capabilities. Many organizations pair osquery with an EDR or SIEM for response actions, or use it as the telemetry layer inside platforms like Fleet or Kolide.

Yes. osquery is commonly deployed at scale using management platforms such as Fleet, Kolide, or Elastic Agent. These provide centralized query scheduling, policy enforcement, live query execution, and result aggregation across large fleets of endpoints.

Yes. osquery is widely used for compliance auditing because its SQL tables expose installed packages, kernel modules, disk encryption status, firewall rules, SSH configuration, and user accounts. Queries can be scheduled as policies to continuously verify systems against CIS benchmarks or internal baselines.

Metadata

Official Website Visit Website

Category Info

Endpoint Visibility covers tools that provide deep, queryable insight into the state and behavior of endpoints, enabling threat hunting, incident response, compliance auditing, and detection engineering across Windows, macOS, and Linux systems.

Added On

September 16, 2026

Last Updated

September 16, 2026