osquery/osquery

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

23524 stars · 2596 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

osquery is a SQL-powered operating system instrumentation, monitoring, and analytics framework that exposes OS data as a high-performance relational database. It lets you query running processes, network connections, users, kernel modules, and more using standard SQL, with a plugin and extensions API for custom tables.

Use cases

• query running processes and open network connections with SQL
• detect suspicious processes with deleted executables
• monitor macOS LaunchDaemons for persistence mechanisms
• inventory installed software and users across a fleet of hosts
• hunt for indicators of compromise on endpoints
• audit file integrity and hardware events

When to choose

• you need SQL-based visibility into operating system state for security or compliance
• you want a cross-platform endpoint telemetry agent for Linux, macOS, and Windows
• you are building intrusion detection or host monitoring on top of queryable system data

When to avoid

• you need application-level APM or metrics rather than OS-level data
• you want a turnkey SIEM with dashboards and alerting out of the box
• you only need log aggregation without ad-hoc system queries

Facets

framework · maturity active

monitoring security database logging analytics security monitoring operating-systems developer-tools windows cross-platform cpp endpoint-security intrusion-detection sql system-instrumentation host-monitoring osquery linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="osquery/osquery")