Open-source alternatives to Osquery

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

SQLiteStudio is an open-source graphical tool for browsing, editing, and managing SQLite database files. It combines a full-featured SQL editor with syntax highlighting, a visual database schema designer for creating entity-relationship diagrams, and a plugin-based extensibility platform that allows adding custom functionality through C/C++, JavaScript, Tcl, or Python. The application distinguishes itself through its multi-language scripting engine, which embeds JavaScript, Tcl, and Python interpreters to enable user-defined functions and scripts within SQL queries. It supports encrypted data

This application is a desktop utility for managing, editing, and visualizing local database files. It provides a graphical interface for executing SQL queries, designing database structures, and performing routine maintenance tasks on data stores. The software distinguishes itself through its support for encrypted database files, allowing users to manage password-protected data using modular cryptographic extensions. It also offers built-in tools for data analysis, enabling the generation of graphical charts and plots directly from query results to identify trends within datasets. Beyond its

MindsDB is an AI-native database engine that treats machine learning models and autonomous agents as virtual tables. By mapping external data sources, predictive models, and third-party services directly into the database schema, it enables users to perform inference, data retrieval, and complex orchestration using standard SQL syntax. The platform distinguishes itself through an autonomous agent orchestrator that executes iterative reasoning loops, allowing agents to plan data access and synthesize natural language responses from connected knowledge bases. It functions as a federated data ga

Turso is a distributed SQL database platform that provides managed, edge-hosted SQLite instances. It functions as a serverless database provider, enabling the deployment of relational databases that synchronize data across multiple geographic regions to support high availability and performance. The platform distinguishes itself by utilizing a fork of SQLite as its core storage engine, which supports both local file storage and remote network-based replication. It employs an edge-optimized proxy to route queries through a global network, minimizing latency by connecting users to the nearest d

dsq is a command-line interface and data engine for executing SQL queries against local structured files, such as CSV, JSON, Parquet, and Excel, without requiring a formal database import. It functions as a schema-inference engine that automatically detects data types and maps heterogeneous file structures into relational tables for analysis. The tool utilizes a lazy stream data processor and checksum-based disk caching to handle large datasets with minimal memory usage. It provides a persistent interactive shell for iterative data exploration, allowing users to inspect inferred schemas and r

Octosql is a federated SQL query engine, data transformer, and streaming SQL processor. It allows users to execute single SQL statements across multiple disparate data sources, including different database types and file formats, to merge and transform results into a unified set. The system distinguishes itself by treating CSV, JSONLines, and Parquet files as virtual tables and utilizing a plugin-based architecture to extend connectivity to external storage engines. It functions as a streaming processor for infinite data streams, using watermarks, retractions, and tumbling windows to maintain

Android-Debug-Database is a specialized utility for extracting, inspecting, and editing mobile data on Android devices. It serves as a database debugger and SQLite inspector that provides a web-based interface for managing database records and shared preference key-value stores. The project distinguishes itself by supporting encrypted database decryption via provided passwords and the ability to map and inspect volatile in-memory databases. It also includes a data export tool that transfers database files from the private application directory to a local machine for external analysis. The to

PyWxDump is a data recovery and export utility designed to extract, decrypt, and convert proprietary mobile messaging databases into readable formats for archival and recovery. It specifically functions as a tool to read and parse encrypted SQLite databases used by WeChat to retrieve chat history and user data. The project focuses on the preservation of conversation history and the forensic recovery of application data for archival or legal purposes. It enables the conversion of proprietary message stores into portable, open formats to prevent data loss from account deletion or device migrati

sqlite-vec is a C-based vector library and SQLite extension that adds virtual tables for storing and querying high-dimensional embeddings. It functions as a database plugin for performing nearest neighbor searches using distance metrics such as L2, cosine, and Hamming distance. The project provides a portable embedding store that supports deployment across Android, iOS, desktop environments, and web browsers via WebAssembly. It distinguishes itself by converting numerical arrays into compact binary formats and utilizing quantization to reduce the memory footprint and storage size of vector in

GRDB.swift is a comprehensive SQLite toolkit and object-relational mapper for Swift. It provides a database wrapper that handles local data persistence, connection management, and encrypted file storage for Apple platforms. The library features a dedicated observation framework that tracks database changes to automatically synchronize the application state and user interface in real time. It distinguishes itself with a type-safe query builder and a protocol-based mapping system that converts database rows into structured Swift objects. The toolkit covers a broad range of administrative and o

This project is a Go language driver for the SQLite database. It provides a relational database interface and a Cgo wrapper that connects Go applications to SQLite for persistent local data storage and query execution. The implementation serves as a provider for JSON document storage and local full-text search. It enables the creation, querying, and modification of JSON data and the implementation of searchable indexes for large text datasets directly within the database. The driver supports standard SQL query execution for both file-based and in-memory storage. It includes capabilities for

Steampipe is a cloud infrastructure query engine and API-to-SQL mapper that translates REST and GraphQL API responses into relational rows and columns. It allows for the retrieval and joining of real-time data from multiple cloud service providers using a relational database interface. The project functions as a PostgreSQL foreign data wrapper and an SQLite API extension, mapping external API endpoints to virtual tables. This enables the use of standard SQL to query live cloud services and aggregate data from different providers and service accounts into a single unified dataset. The system

lnav is a terminal-based log viewer and analyzer designed for aggregating, filtering, and analyzing multiple log files in a single chronological view. It functions as a console application that can replace the system pager, providing syntax highlighting and document navigation for system or application logs. The project distinguishes itself by mapping unstructured log data to virtual SQLite tables, enabling the use of SQL and PRQL for structured data analysis, aggregations, and relational queries. It further differentiates its capability set through native integration for retrieving and taili

sqlite-web is a Python-based web application that provides a graphical user interface for browsing, querying, and editing SQLite database files. It functions as a database management tool that allows users to manipulate table data and manage schemas through a web browser rather than using a command line or raw SQL scripts. The application includes utilities for data migration, enabling the import and export of database content via JSON and CSV file formats. It also provides secure remote access to databases through password access control and SSL encryption. The project covers broader admini

sqlite-net is a lightweight object-relational mapper and data access layer for SQLite. It provides tools for translating application classes into database tables, managing records through an entity mapper, and implementing local data persistence. The library includes an encrypted wrapper that secures database files using connection keys and native encryption configurations. It also features a data access layer that supports both synchronous and asynchronous operations to maintain application responsiveness during disk access. The project covers a range of database management capabilities, in

sqlean is a collection of SQLite extension libraries implemented as C-based shared libraries. It provides a suite of additional scalar and table-valued functions that expand the native capabilities of the SQLite database engine. The project provides specialized toolsets for cryptography, advanced mathematics, networking, and filesystem access. These include binary hashing and encoding, statistical analysis, IP address validation, and the ability to map CSV files or filesystem paths as virtual tables. The library also includes comprehensive text processing tools such as regular expressions, f

Datasette is a tool for publishing and sharing SQLite databases as public websites. It functions as a data publishing system that provides searchable interfaces and JSON APIs to expose the contents of SQLite files. The project enables both server-side and client-side execution. It can operate as an API server or as a database browser that runs entirely within a web browser using WebAssembly, allowing for serverless database access. The system supports a variety of deployment strategies, including containerized images for cloud hosting and a local development server for testing. It includes c

fmdb is an object-oriented SQLite database library and persistence layer for native macOS and iOS environments. It provides an Objective-C wrapper that encapsulates the low-level C API, allowing applications to manage local relational data storage and embedded database connections through a high-level interface. The library focuses on thread-safe database access by synchronizing operations across multiple threads using serialized queues to prevent data corruption and race conditions. It includes specialized capabilities for secure local storage, such as database encryption and the management

Anko is an Android Kotlin library designed to simplify application development through a set of domain-specific languages and extensions. It functions as a programmatic UI DSL, an SQLite wrapper, an SDK utility, and an asynchronous framework. The project provides a declarative layout system that allows developers to build user interfaces through code instead of static XML markup. It distinguishes itself by offering a fluent database layer that eliminates manual cursor management and a concurrency system that uses weak references to prevent memory leaks in activities. The library covers broad

Wazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito

The Datadog Agent is an infrastructure monitoring agent and host telemetry collector. It functions as a background process that gathers system metrics and application health data to send to a centralized monitoring platform. The project operates as a plugin-based metric collector, using a modular system of independent check scripts to gather data from various third-party services and applications. It serves as a remote telemetry transmitter, providing a pipeline to stream infrastructure and system information to a remote analysis and alerting backend. Its capabilities cover application perfo

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

cr-sqlite is a multi-master database replication system that uses conflict-free replicated data types to ensure eventual consistency across distributed nodes. It provides the core capabilities for offline-first data synchronization, allowing multiple database instances to merge concurrent updates and reach a consistent state. The project distinguishes itself through a combination of CRDT-based data replication and a WASM-based database engine, enabling full SQL execution and state persistence within web browsers. It supports peer-to-peer replication and cross-tab synchronization, utilizing ca

KodExplorer is a web-based file manager and remote server administration tool that provides a desktop-like interface for organizing and managing files in a browser. It functions as an enterprise file sharing platform and an online document previewer, allowing users to view hundreds of file formats without local software installations. The system is distinguished by a plugin-based API gateway that exposes RESTful endpoints for third-party integrations and custom functional extensions. It also includes a browser-based code editor with syntax highlighting and autocomplete for over 120 languages,

q is a command-line utility for the processing, filtering, and aggregation of tabular text and database files using standard SQL syntax. It functions as a query engine that treats CSV and TSV files, as well as standard input, as relational database tables. The tool distinguishes itself by providing a persistent cache layer that stores processed tabular data in a binary format to accelerate repeated queries on large datasets. It also maps individual filenames or stream identifiers to relational table names, enabling SQL joins across disparate text files. The project covers a broad range of da

Perfetto is a platform for system-level performance tracing and analysis on Linux and Android. It combines a high-throughput trace recorder, a SQL-based query engine, and a browser-based visualizer into a single toolchain. The platform covers CPU scheduling and call-stack profiling, native and Java heap memory allocation tracking, GPU and graphics events, and system-wide counters such as CPU frequency and power consumption. The architecture decouples trace recording from offline analysis, using a compact protobuf format for event encoding and columnar storage for efficient SQL queries. The we