Questions tagged [osquery]

osquery is an open-source, cross-platform endpoint security monitoring and system information tool. It is either run locally in an interactive command-line session, or is deployed remotely with scheduled queries that report to a central logging system of the user's choice. It has an SQL-based query interface that presents OS-level data as virtual SQL tables, for flexible and powerful relational-data requests.

Tagging Recommendation

Use the osquery tag for all osquery-related questions. If your question includes issues specific to a particular operating system platform, you can include a tag like windows, macos, or linux. osquery is an extensible tool for gathering OS-level system information; many development issues are as much related to the intricacies of platform APIs as they are to osquery itself.

If your question is more related to the SQL language and its various syntax, maybe the sql tag is also appropriate.

Other osquery Resources

osquery main site

osquery user and developer documentation

osquery community Slack chat

osquery's GitHub source code repository

78 questions
-1
votes
1 answer

Osquery how to run select command?

I installed osquery on my Kali Linux 2019.3 (VirtualBox VM) via using this link: https://osquery.io/downloads/official/4.3.0 (I picked debian) I tried to run select comond, nothing happens. Only apperas ...> For example when I tried select* from…
quality38
  • 35
  • 5
-2
votes
2 answers

Automatically granting full disk access for osquery in mac

I am customizing the plist file to start osquery through my code. I have taken the osqueryd file and renamed it to testosqueryd now through my plist, io.testosquery.agent.plist. I am just loading testosqueryd. It is osquery is loading but. But now I…
User0987
  • 91
  • 1
  • 6
-3
votes
1 answer

How do you interrupt an osquery query that's been running for too long?

I have run a sqlite (via osqueryi to be more precise) query on the command line, after several minutes the results keep on coming. ^C isn't interrupting it. Are there other options?
ychaouche
  • 4,922
  • 2
  • 44
  • 52
1 2 3 4 5
6