osquery

Name: osquery
Brand: osquery

Open-source SQL framework for querying and auditing Linux, Windows, and macOS endpoints.

softwareSecurity Auditingendpoint visibilitysql queryingopen source

Visit Website

Our Verdict

Best for

Security and DevOps teams that want SQL-based, open-source endpoint visibility they can build fleet tooling around.

Skip if

You want a turnkey EDR product with a built-in management console out of the box.

What is osquery?

osquery is an open-source endpoint instrumentation framework, originally created at Facebook, that exposes an operating system as a set of relational tables so administrators can query things like running processes, open network connections, installed packages, and file metadata using standard SQL. It can be used interactively through the osqueryi shell or scheduled to run continuously as the osqueryd daemon for ongoing monitoring. Because queries are just SQL, security and compliance teams can write checks like finding processes running without a binary on disk, a common indicator of a hidden or deleted malicious process. osquery is released under the Apache License, runs on Windows, macOS, and most Linux distributions since 2011, and is backed by an active community including projects like Fleet, Kolide's launcher, and osctrl for fleet-scale management.

SpecificationsAI-estimated

deploymentSelf-hosted

open source✅ Yes

api available✅ Yes

support optionsCommunity Slack, documentation

Key Features of osquery

Exposes operating system state (processes, network connections, packages, files) as queryable SQL tables.

Supports interactive queries via the osqueryi shell for ad hoc investigation.

Runs as the osqueryd daemon to continuously log scheduled query results for ongoing monitoring.

Runs on Windows, macOS, and most Linux distributions released since 2011.

Is released under the Apache License and has been open source since 2014.

Powers fleet-scale device management through community projects like Fleet, osctrl, and Kolide's launcher.

Enables detection queries such as finding processes running without a binary on disk.

Is backed by an active community and sponsors including AWS, GitHub, and Trail of Bits.

Use Cases for osquery

Detecting suspicious processes

A security team schedules a query to find processes whose on-disk binary has been deleted, a sign of a hidden attacker process.

Compliance auditing

An admin queries installed packages and OS versions across the fleet to check compliance with patch policies.

Incident response investigation

A responder uses osqueryi interactively to inspect network connections and running processes on a potentially compromised host.

Fleet-wide endpoint visibility

An organization deploys osqueryd with Fleet to centrally collect and monitor telemetry from thousands of endpoints.

Pros & Cons of osquery

Pros

Free and fully open source with no licensing cost
Extremely flexible since any question becomes a SQL query
Strong ecosystem of community tools for fleet-scale deployment
Cross-platform coverage across Windows, macOS, and Linux

Cons

No official managed UI or dashboard from the core project itself, third-party tools like Fleet fill that gap
Requires SQL knowledge and query-writing to get full value
Setting up fleet-wide scheduled queries takes more engineering effort than a turnkey EDR product