facebook/osquery
Osquery
Osquery is an operating system instrumentation tool that treats system state as a relational database. It maps operating system telemetry and kernel data into virtual tables, allowing users to explore processes, hardware events, and performance data using standard SQL queries.
The project provides a plugin and extensions API that enables the implementation of custom telemetry tables to monitor specific system concepts. It also includes a remote communication interface to exchange telemetry data and query results with external applications.
The system supports scheduled monitoring to track operating system state across multiple hosts over time. Its capabilities cover system state analytics, enterprise endpoint monitoring, and the retrieval of remote system telemetry.
Features
- SQL-Based - Maps operating system telemetry and kernel data into virtual relational tables for querying via standard SQL.
- System State Querying - Exposes OS internals as relational tables for diagnosing system behavior via SQL inspection.
- SQLite Integration - Integrates an embedded SQLite engine to parse SQL queries and manage system data retrieval.
- Virtual Tables - Implements virtual tables that translate SQL row requests into specific operating system telemetry fetches.
- Extension APIs - Provides an extension API that allows developers to implement new SQL tables for custom telemetry.
- System Instrumentation Frameworks - Instruments the operating system by treating its state as a relational database queried with SQL.
- Telemetry Table Plugins - Implements a plugin system for adding custom telemetry tables to the relational system state model.
- Endpoint Monitoring Agents - Acts as a unified agent for tracking hardware, network, and process activity across enterprise endpoints.
- Distributed Query Schedulers - Executes SQL queries on a fixed timetable across multiple hosts to track OS state over time.
- Scheduled State Polling - Provides the ability to execute scheduled queries on a fixed timetable to track system state changes.
- System Telemetry Collectors - Gathers performance metrics and system information from distant hosts for external monitoring.
- Custom Telemetry Extensions - Enables the development of custom telemetry tables via plugins to monitor specific system concepts.
- Forensic Analysis Tools - Cross-platform system data collection and forensic analysis.
- System Instrumentation and Monitoring - Exposes operating system state as a queryable relational database.
