About osquery
osquery lets you ask questions about the state of your computers using SQL. It runs on Windows, macOS and Linux.
What it does
osquery exposes operating system data, such as running processes, as tables. You query those tables with basic SQL, so one question can be asked across many machines. Security and IT teams use it to look for suspicious activity and to check configuration. The project is built with testing for memory leaks and thread safety.
Key features
- SQL queries against system data as tables
- Find processes whose program file has been deleted
- Runs on Windows, macOS and most Linux systems
- Open source under the Apache License
- Used for security, compliance and DevOps checks
Who it's for
Security teams doing endpoint monitoring, IT administrators and DevOps engineers who need visibility across a fleet of machines.
Pricing and good to know
osquery is released under the Apache License and is free to use. It runs as an agent on each device, and you decide how to collect and store the results. Fleet management tools are often used with it to run queries across many devices at once. Running queries on many devices adds load, so schedule them with care.
Highlights
- Query processes and system data with SQL
- Find processes whose program file was deleted
- Run on Windows, macOS and most Linux systems
- Check security and compliance settings
- Use the open source code under Apache License
