osquery

Open source

Open source tool that exposes operating system state as SQL-queryable tables for endpoint visibility.

by osquery FoundationOfficial site ↗Source code ↗

Pricing: free
Free tier: true
License: dual-license
Open source: Yes

Editorial review

osquery has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://osquery.readthedocs.io/en/stable/Verified
Tags(open-source;cloud-native): endpoint-telemetry, sql, security, intrusion-detection, open-sourceVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hosted, desktopVerification pending

Pricing · Licensing

Free plan(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): dual-licenseVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerification pending
Source repository(HTTPS URL): https://github.com/osquery/osqueryVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0, GPL-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): SQL-based operating system instrumentation, scheduled queries via the osqueryd daemon, interactive SQL shell (osqueryi), file integrity monitoring, process auditing, log aggregation via plugin architectureVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending
CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Security and IT teams querying endpoint state with SQL on Windows, macOS and Linux via osqueryd schedulesVerification pending
Company-size fit(individual;SMB;mid-market;enterprise): individual, SMB, mid-market, enterpriseVerification pending
Primary use cases(build;monitor;automate): endpoint monitoring across infrastructure, security analytics and intrusion detection, incident response, systems operations troubleshootingVerification pending
Skill level(beginner;intermediate;advanced;specialist): specialistVerification pending

Lifecycle · Versioning

Current version(1.12.3): 5.24.0Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerification pending

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): communityVerified

User reviews

Review policy

No published reviews yet.