cloudparts

osquery

An agent for Linux, macOS and Windows that exposes the operating system as SQL tables, so you can query processes, users, open ports, installed software and more, interactively or on a schedule that logs what changed.

Linux Foundation project
What it is
Threat detection (SIEM)
Type
Open source
Made by
osquery project (Linux Foundation), started at Facebook
Foundation
The Linux Foundation, joined June 2019. Moved from Facebook in 2019; run by a Technical Steering Committee from several companies
License
Apache 2.0 or GPL 2.0 (your choice)
Facts checked
28 October 2026
Website Source code

What it is

osquery turns a machine’s state into roughly 290 virtual tables: processes, users, listening_ports, kernel_modules, browser extensions, installed packages, certificates, file hashes and many platform-specific ones. Its SQL is a superset of SQLite’s, so you can filter and JOIN tables, such as listening ports to the processes that own them; it is SELECT only, and INSERT, UPDATE and DELETE do nothing unless an extension supports them. osqueryi is an interactive shell for exploring one machine or investigating an incident. osqueryd is the daemon you deploy to a fleet: it runs scheduled queries, each with an interval in seconds, and logs only the differences since the last run as rows added or removed, or a full snapshot if you ask for one.

Most tables read the current state when queried, but evented tables keep a buffer of events between runs: process_events and socket_events from the Linux Audit system, bpf_process_events from eBPF on kernel 4.18 and newer, and es_process_events from Apple’s EndpointSecurity framework. Results go to logger plugins, including files, syslog, the Windows Event Log, a TLS endpoint, Kafka and Amazon Kinesis or Firehose, and from there into a SIEM where detection rules run. A watchdog stops queries that use too much CPU or memory and denylists them for a day. Tables can be added through a Thrift-based extensions API. The project is dual-licensed under Apache 2.0 and GPL 2.0, and 5.24.0 came out on October 9, 2026.

Why teams pick it

  • One query language for three operating systems: the same SQL asks about processes, users or ports on Linux, macOS and Windows
  • Differential logging keeps output small: a scheduled query emits only rows that appeared or disappeared since its last run
  • Broad and growing coverage, from kernel modules to browser and editor extensions; an ai_agent_skills table listing coding agents’ installed SKILL.md packages was added in October 2026
  • Vendor-neutral: no single company controls it since Facebook handed it to the Linux Foundation, whose osquery effort was formed with Facebook, Google, Kolide, Trail of Bits, Uptycs and Dactiv

Watch out for

  • It collects data; it does not alert, block or correlate. Detection rules, dashboards and response live in the SIEM or management server that receives its logs
  • Managing thousands of agents needs a separate server for remote configuration and log collection, through the TLS plugins or a commercial product
  • Evented tables are off by default and depend on platform mechanisms with their own flags and costs, such as Linux Audit, eBPF or macOS EndpointSecurity
  • Point-in-time tables only see what exists when the query runs, so a short-lived process between two scheduled runs is missed unless an evented table catches it

Alternatives

What all threat detection (siem) have in common →Compare side by side →
OCSFOpen sourceThe Open Cybersecurity Schema Framework: an open, vendor-neutral schema for security events and findings, so logs from firewalls, endpoints, identity providers and clouds arrive with the same field names and can be queried and correlated together.RSigmaOpen sourceA Rust toolkit that parses Sigma rules, compiles them into matchers and evaluates them against log events in real time, correlations included, as one self-contained binary.SigmaOpen sourceAn open YAML format for detection rules over log events, with a community repository of more than 3,000 rules and tools that convert them into each SIEM’s query language.

How it fits with other technologies

Queries from the osquery README, run in osqueryi · sql

-- Processes whose executable has been deleted from disk
SELECT * FROM processes WHERE on_disk = 0;

-- Which processes listen on all interfaces, and on which ports
SELECT DISTINCT processes.name, listening_ports.port, processes.pid
  FROM listening_ports JOIN processes USING (pid)
  WHERE listening_ports.address = '0.0.0.0';

-- Scheduled in osqueryd’s config, this logs only users who logged in or out since the last run:
-- { "schedule": { "logged_in_users": { "query": "SELECT * FROM logged_in_users;", "interval": 300 } } }

See it in a real stack

No architecture uses osquery yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2014–2026

Facebook developed osquery in 2014 as a tool that makes it easier to collect low-level system information and spot potential security issues, built around one idea: present the operating system as a high-performance relational database, so that anyone can investigate a machine by writing SQL.

By 2019 the project had, in Trail of Bits’ words, “outgrown its original home as a Facebook project”: about 35 pull requests had been merged in nine months, few from outside Facebook, a move to Facebook’s Buck build system troubled outside contributors, and community forks such as Trail of Bits’ osql had appeared. On June 18, 2019, a day before the QueryCon conference, the Linux Foundation announced its intent to form a foundation for osquery, with Dactiv, Facebook, Google, Kolide, Trail of Bits and Uptycs participating; the project then had more than 280 contributors and 5,000 commits. Facebook handed over control of funding, infrastructure and code review to a Technical Steering Committee of engineers from Facebook, Trail of Bits, Google and Kolide plus an independent consultant, and the forks were merged back into one osquery.

Since then releases have kept adding tables and event sources; 5.24.0 came out on October 9, 2026.

Why it’s built this way

SQL as the interface
Most engineers already know SQL, and expressing the operating system as tables lets them filter and join data that would otherwise need many separate commands and scripts.
Differential results by default
Logging only what changed between runs of a scheduled query keeps the volume sent to central logging small across large fleets.
Logging through plugins
osqueryd’s logging plugs into an existing log aggregation pipeline, and components such as config and logger plugins can be swapped at runtime, so osquery fits the systems a team already runs instead of bringing its own back end.

Timeline

  1. 2014

    Facebook develops osquery; the GitHub repository is created in July

  2. 2019

    Linux Foundation announces its intent to form an osquery foundation, on June 18; the Facebook code and the osql fork are merged

  3. 2026

    osquery 5.24.0 released on October 9

Sources10 · facts checked 28 October 2026

Improve this page on GitHub