README
osquery
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework.
Available for Linux, macOS, and Windows.
Information and resources
- Homepage: osquery.io
- Downloads: osquery.io/downloads
- Documentation: ReadTheDocs
- Stack Overflow: Stack Overflow questions
- Table Schema: osquery.io/schema
- Slack: Browse the archives or Join the conversation
- Build Status:
- CII Best Practices:
What is osquery?
osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.