osquery

osquery is an endpoint visibility tool open-sourced by Facebook (now Meta) in 2014.

The core concept of osquery is to abstract the operating system as a relational database, mapping system state information to queryable data tables.

osquery can use SQL syntax to obtain consistent query results across Linux, macOS, and Windows platforms.

osquery's processes table reads the /proc filesystem on Linux, calls the libproc API on macOS, and calls the Win32/WMI interface on Windows.

osquery's virtual tables dynamically fetch data only when a query is executed rather than pre-caching it, so the cost of a full table scan represents real system call overhead.

osquery's built-in scheduler periodically executes queries at preset intervals and sends result differences to the logging pipeline, a pattern known as differential queries.

Poorly designed osquery queries (such as frequently scanning the entire filesystem, performing unindexed joins on high-cardinality tables, or setting excessively short query intervals) can cause CPU usage to spike on large-scale hosts.

Fleet is currently the most mainstream open-source osquery management platform, providing a Web UI and API for uniformly distributing queries, managing host inventory, and collecting results.

osquery typically writes results to local log files, which are then forwarded by log collection agents such as Filebeat and Fluentd to SIEM/data lakes such as Elasticsearch, Splunk, or AWS S3.

The data pipeline of "osquery → log collection → SIEM → alerting" is a typical pattern for enterprise endpoint detection architecture.

When adopting an osquery detection query library, gray-scale testing should first be conducted in a small-scale environment to evaluate performance impact, rather than blindly deploying to the full fleet.