Endpoint SQL Querying Tools
These open-source tools enable security teams to execute SQL queries across distributed endpoints for incident response.
Endpoint SQL Querying Tools
Find the best repos with AI.We'll search the best matching repositories with AI.
- facebook/osquery
facebook/osquery
23,318View on GitHubOsquery is an operating system instrumentation tool that treats system state as a relational database. It maps operating system telemetry and kernel data into virtual tables, allowing users to explore processes, hardware events, and performance data using standard SQL queries. The project provides a plugin and extensions API that enables the implementation of custom telemetry tables to monitor specific system concepts. It also includes a remote communication interface to exchange telemetry data and query results with external applications. The system supports scheduled monitoring to track op
Osquery is the industry-standard instrumentation tool that exposes operating system state as a relational database, enabling you to perform SQL-based queries across distributed endpoints for threat hunting and incident response.
C++Endpoint Monitoring Agents - osquery/osquery
osquery/osquery
23,113View on GitHubOsquery is a unified endpoint monitoring framework that exposes operating system internals as relational tables. By representing hardware, network, and process activity as structured data, it allows users to retrieve system state and configuration information using standard SQL syntax. The system distinguishes itself through a cross-platform abstraction layer that normalizes disparate operating system interfaces into a consistent schema across Windows, macOS, and Linux. It supports both interactive local analysis via a command-line shell and distributed fleet orchestration, where recurring qu
Osquery is the industry-standard endpoint query engine that exposes system internals as SQL tables, providing the exact cross-platform visibility, real-time event monitoring, and distributed fleet management required for threat hunting.
C++Endpoint Monitoring Agents - wazuh/wazuh
wazuh/wazuh
14,779View on GitHubWazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito
Wazuh is a comprehensive security platform that provides the required endpoint visibility, distributed fleet management, and real-time threat hunting capabilities, though it relies on its own rule-based engine and log analysis rather than a pure SQL-based interface for querying infrastructure data.
CEndpoint Monitoring Agents - velocidex/velociraptor
Velocidex/velociraptor
3,769View on GitHubVelociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Velociraptor is a comprehensive endpoint visibility and incident response platform that uses a specialized SQL-like query language to hunt for threats and collect forensic data across distributed fleets.
GoThreat Hunting Operations - dinedal/textql
dinedal/textql
9,109View on GitHubTextQL is a command line SQL query engine designed to execute relational queries directly against structured text files, such as CSV and TSV, without requiring a database import. It functions as a relational text file analyzer and a CSV processor that treats plain text files as virtual tables for filtering, joining, and aggregating data. The tool is built as a pipe-compatible data transformation utility, allowing it to process data from standard input and output formatted datasets. It enables relational joins across multiple files or directories within a single query to analyze relationships
This is a command-line utility for querying flat files like CSVs, which lacks the endpoint visibility, fleet management, and security-specific features required for a threat hunting and incident response engine.
GoSQL Query Execution Engines - cwida/duckdb
cwida/duckdb
38,822View on GitHubDuckDB is an embedded, in-process analytical SQL database and OLAP database management system. It functions as a data engine for Parquet and CSV files, allowing users to execute complex SQL queries on large datasets without requiring a separate server process. The system is designed for local analytical processing and embedded data science workflows. It enables the direct querying and analysis of Parquet and CSV files from disk, bypassing the need to load data into a permanent database. The engine provides high-performance analytical SQL execution, including support for window functions and
DuckDB is a high-performance analytical SQL engine for local data processing, but it lacks the endpoint visibility, fleet management, and security-specific telemetry features required for threat hunting and incident response.
C++SQL Query Execution Engines
