Repository files navigation

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework.
Available for Linux, macOS, and Windows.

• Homepage:osquery.io
• Downloads:osquery.io/downloads
• Documentation:ReadTheDocs
• Stack Overflow:Stack Overflow questions
• Table Schema:osquery.io/schema
• Slack:Browse the archives orJoin the conversation
• Build Status:
• CII Best Practices:

osquery exposes an operating system as a high-performance relational database. This allows you towrite SQL-based queries to explore operating system data. With osquery, SQL tables representabstract concepts such as running processes, loaded kernel modules, open network connections,browser plugins, hardware events or file hashes.

SQL tables are implemented via a simple plugin and extensions API. A variety of tables already existand more are being written:https://osquery.io/schema. To bestunderstand the expressiveness that is afforded to you by osquery, consider the following SQLqueries:

List theusers:

SELECT*FROM users;

Check theprocesses that have a deleted executable:

SELECT*FROM processesWHERE on_disk=0;

Get the process name, port, and PID, for processes listening on all interfaces:

SELECT DISTINCTprocesses.name,listening_ports.port,processes.pidFROM listening_portsJOIN processes USING (pid)WHERElistening_ports.address='0.0.0.0';

Find every macOS LaunchDaemon that launches an executable and keeps it running:

SELECT name, program|| program_argumentsAS executableFROM launchdWHERE (run_at_load=1AND keep_alive=1)AND (program!=''OR program_arguments!='');

Check for ARP anomalies from the host's perspective:

SELECT address, mac,COUNT(mac)AS mac_countFROM arp_cacheGROUP BY macHAVINGcount(mac)>1;

Alternatively, you could also use a SQL sub-query to accomplish the same result:

SELECT address, mac, mac_countFROM    (SELECT address, mac,COUNT(mac)AS mac_countFROM arp_cacheGROUP BY mac)WHERE mac_count>1;

These queries can be:

• performed on an ad-hoc basis to explore operating system state using theosqueryi shell
• executed via aschedulerto monitor operating system state across a set of hosts
• launched from custom applications using osquery Thrift APIs

To download the latest stable builds and for repository informationand installation instructions visithttps://osquery.io/downloads.

We use a simple numbered versioning schemeX.Y.Z, where X is a major version, Y is a minor, and Z is a patch.We plan minor releases roughly every two months. These releases are tracked on ourMilestones page. A patch release is used when there are unforeseen bugs with our minor release and we need to quickly patch.A rare 'revision' release might be used if we need to change build configurations.

Major, minor, and patch releases are tagged on GitHub and can be viewed on theReleases page.We open a newRelease Checklist issue when we prepare a minor release. If you are interested in the status of a release, please find the corresponding checklist issue, and note that the issue will be marked closed when we are finished the checklist.We consider a release 'in testing' during the period of hosting new downloads on our website and adding them to our hosted repositories.We will mark the release as 'stable' on GitHub when enough testing has occurred, this usually takes two weeks.

Building osquery from source is encouraged! Check out ourbuildguide. Alsocheck out ourcontributing guide and join thecommunity onSlack.

There are many osquery fleet managers out there. The osquery project does not endorse, recommend, or test these. They are provided as a starting point

By contributing to osquery you agree that your contributions will belicensed as defined on the LICENSE file.

We keep track of security announcements in our tagged version releasenotes on GitHub. We aggregate these intoSECURITY.mdtoo.

The osquery documentation is availableonline. Documentation for olderreleases can be found by version number,aswell.

If you're interested in learning more about osquery read thelaunchblogpostfor background on the project, visit theusersguide.

Development and usage discussion is happening in the osquery Slack, grab an invitehere!