Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive. Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.
Features
- Allows you to schedule queries to be executed across your entire infrastructure
- Generates logs which indicate state changes in your infrastructure
- It gives you a SQL interface to try out new queries and explore your operating system
- Easy packaging and deploying custom osquery tools
- Osquery's codebase is made up of high-performance, modular components
- Language bindings exist for many languages using a Thrift interface