Endpoint visibility
osquery
Query operating-system state with SQL-style queries for fleet visibility and investigations.
About osquery
osquery exposes operating-system information through a SQL-like interface. It helps defenders query endpoint state and automate selected visibility checks.
What it does
- ✓Query supported host state through structured tables.
- ✓Schedule queries and collect results through compatible tooling.
- ✓Support repeatable endpoint visibility and investigative checks.
Where it fits
- ↗Auditing installed software and selected system settings.
- ↗Hunting for suspicious endpoint artifacts.
- ↗Teaching SQL-style endpoint inspection in a lab.
Next steps
Read the official documentation, learn available tables, and try simple queries on a test machine.