osquery

Why we included this project

osquery exposes the internals of a running machine as relational tables you can query with plain SQL, covering processes, network connections, kernel modules, and file hashes without hand-rolled shell scripts. That is what makes it attractive to security and operations teams who need consistent visibility across many systems, and the same tables work on Linux, macOS, and Windows. The project includes both an interactive shell and a daemon, plus a plugin API for adding custom tables, so it can feed fleet monitoring, compliance checks, or intrusion detection rather than just one-off debugging. If you already write SQL you can start pulling real telemetry within minutes, and for larger fleets it offers scheduled queries and distribution to collect data from thousands of machines. When you manage a sizable estate and want a single auditable way to ask what is actually running, this is a mature foundation to build on.