osquery
A SQL-powered framework for instrumenting, monitoring, and analyzing operating systems across Linux, macOS, and Windows.
What is osquery?
osquery is an operating system instrumentation framework that exposes OS data as relational database tables queryable with SQL. It allows security and operations teams to monitor system state, detect anomalies, and perform analytics across Linux, macOS, and Windows hosts. By representing concepts like running processes, network connections, and file changes as SQL tables, it provides a unified interface for system exploration and monitoring.
Security engineers, DevOps professionals, and system administrators who need to monitor and analyze endpoint security, compliance, and operational state across large fleets of computers. It's particularly valuable for teams building security monitoring platforms or internal infrastructure tooling.
Developers choose osquery because it replaces fragmented OS-specific tools with a consistent SQL interface, enabling complex joins and aggregations across system data. Its extensible plugin architecture and cross-platform support make it uniquely suited for building scalable monitoring solutions without reinventing low-level instrumentation.
Overview
SQL powered operating system instrumentation, monitoring, and analytics.
Use Cases
Best For
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
