Skip to content
THREATWIRE

osquery

Query your endpoints with SQL

Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.

Open sourceApache-2.0 OR GPL-2.0-only
Alternative toCrowdStrike Falcon
Visit website View repository Docs
Homepage of osquery
Official website (osquery.io), captured by ThreatWire.

What osquery does

osquery turns system state into SQL tables: running processes, loaded kernel modules, open network connections, installed packages, browser extensions and hundreds more. Queries can be run interactively (osqueryi) or on a schedule by the daemon (osqueryd), which logs differences over time.

It is used for fleet visibility, intrusion detection and compliance, typically with a fleet manager such as Fleet or a SIEM. The project, created at Facebook, is now hosted by the Linux Foundation.

Key features

  • Hundreds of SQL tables describing the OS
  • Interactive shell and scheduled daemon
  • Linux, macOS and Windows support
  • Event-based tables for process and file events
  • Extensions and remote management APIs

Licence

Apache-2.0 OR GPL-2.0-only · Apache License 2.0 or GNU GPL v2 (your choice) · Open source

GitHub does not detect the licence; the LICENSE file offers a choice between Apache-2.0 and GPL-2.0.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.

Security of osquery itself

9 published advisories for osquery in GitHub repository advisories. Keep the tool updated: security tools often run with broad access.

  • GHSA-4r78-6hg6-33ggCVE-2026-54000high2026-07-01

    Heap buffer overflow via `processes` table (Windows)

  • GHSA-hr28-jvpx-68cxCVE-2026-54001high2026-07-01

    Heap buffer overflow via `authenticode` table (Windows)

  • GHSA-fg78-9q98-62hhCVE-2026-46388medium2026-07-01

    Unprivileged users can temporarily read file carve contents

  • GHSA-4g56-2482-x7q8CVE-2020-26273medium2020-12-15

    sqlite ATTACH allows some filesystem access

  • GHSA-29q7-6g57-5vc6CVE-2017-15028low2020-07-10

    known_hosts should drop privileges

  • GHSA-hx5j-mvj5-rq2mCVE-2017-15027low2020-07-10

    safari_extensions table should not use parent paths for privilege dropping

  • GHSA-3227-mxf9-vw74CVE-2017-15026low2020-07-10

    ie_extensions table susceptible to SQL injection

  • GHSA-pjmv-4494-jx3fCVE-2020-1887low2020-07-10

    osquery does not validate TLS SNI hostname

  • GHSA-2xwp-8fv7-c5pmCVE-2020-11081low2020-07-10

    osquery susceptible to DLL search order hijacking of zlib1.dll

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

Endpoint visibility and responseDigital forensics and incident response#endpoint#sql#linux-foundation#fleet#security#monitoring#intrusion-detection#hacktoberfest

Related tools

  • radare2

    UNIX-like reverse engineering framework

    Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.

    Stars
    25k
    Forks
    3.4k
    Last commit
    today
    LGPL-3.0-onlyOpen sourceReverse engineering and malware analysis
    Alternative toIDA Pro

  • Wireshark

    Network protocol analyser

    The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.

    Stars
    10k
    Forks
    2.2k
    Last commit
    today
    GPL-2.0-onlyOpen sourceNetwork scanning and analysis

  • YARA

    Pattern matching for malware research

    Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.

    Stars
    10k
    Forks
    1.6k
    Last commit
    4 days ago
    BSD-3-ClauseOpen sourceReverse engineering and malware analysis
Share on X@threatwire_https://www.threatwire.tech/tools/osquery