osquery: ask every endpoint a question in SQL

You need to know who has local admin and what's listening on port 3389, and the inventory report has no column for either. osquery lets you ask those questions in SQL on Windows, macOS and Linux, and get the answer back from every device. Here's what it is, how it works, ten queries you can paste today and the tools that run it at scale.

TL;DR

• What it is. osquery is a free, open-source agent that turns an operating system into SQL tables.
• Origin. Facebook released it in 2014, and the Linux Foundation hosts it today.
• How it runs. osqueryi answers one-off questions, and osqueryd runs scheduled queries.
• The limit. It reads state and changes nothing, so fixes need another tool.
• Who builds on it. Fleet, 1Password Device Trust, CrowdStrike Falcon for IT and Uptycs run it underneath.

What is osquery?

osquery is an agent that makes an operating system look like a database. Processes, users, installed apps, open ports, disk encryption and browser extensions each show up as a table. You ask with plain SQL, the same SELECT you'd write against any database, and the agent reads the answer live from the OS.

Facebook's security team open-sourced osquery in October 2014. In June 2019 the project moved to the Linux Foundation, and a Technical Steering Committee runs it today. The code is dual-licensed, Apache 2.0 or GPL 2.0, your pick.

It runs on Windows, macOS and Linux, on both x86 and ARM. FreeBSD support was dropped in the 5.x line. The current release is 5.24.1, from 29 October 2026, and the repo sat at 23,758 GitHub stars when we checked in November 2026.

The 5.24.1 schema lists 294 tables. 192 of them work on macOS, 166 on Linux and 122 on Windows, and a table can appear on more than one. The table specs live in the osquery repo, one file per table, so you can check a column before you build a query on it.

How osquery works

Tables instead of commands

The tables are virtual. Nothing sits in a database file waiting for you. When a query hits processes, osquery reads the process list at that moment and hands back rows. Like the spoon in The Matrix, the table only exists while you look at it.

That's the whole trick, and it's a good one. One language replaces Get-Process, ps, lsof, netstat, registry reads and plist parsing. Joins work too, so you can match an open port to the process holding it in one statement, on any of the three platforms.

osqueryi and osqueryd

osquery ships two ways to run it. osqueryi is the interactive shell. Run it on one machine, type a query, get a table back. It doesn't talk to the daemon and doesn't need admin rights, though some tables return fewer rows without them.

osqueryd is the daemon, and it's the part that matters once you manage more than one machine. It runs a schedule of queries at set intervals. The first run logs every row as "added". After that it logs only the changes, rows added and removed since the last run. That's differential logging, the default. Mark a query as a snapshot and it logs the full result every time instead.

Scheduled queries can be grouped into packs. The osquery repo ships ready-made packs for IT compliance, vulnerability management, incident response and Windows hardening. They make a fair first schedule, and you'll trim them once you see the log volume.

The defaults worth knowing

Event tables are off by default. process_events, file_events and their siblings stay empty until you turn events on with the matching flags. On macOS, the EndpointSecurity table also needs Full Disk Access, and without it the table stays silently empty.

A watchdog keeps the agent polite. By default it restarts a worker that uses more than 200 MB of memory, or more than 10% CPU for 12 seconds. Both limits are set by command-line flags. A heavy query can trip it, so test new queries on a handful of machines before you schedule them everywhere.

Results leave through logger plugins. The default writes local files. TLS, syslog, the Windows Event Log, Kafka, and AWS Kinesis or Firehose are built in, and several can run at once. If you already run a log stack, our ELK stack guide covers where those results usually land.

10 osquery queries IT teams run

Every table and column below is checked against the 5.24.1 schema. Paste them into osqueryi on one machine first. Then schedule the ones you want everywhere.

Inventory

1. Hardware and OS, all platforms. The asset record in one row.

sql
SELECT s.hostname, s.hardware_vendor, s.hardware_model, s.hardware_serial,
       s.cpu_brand, s.physical_memory, o.name AS os_name, o.version, o.build, o.arch
FROM system_info s, os_version o;

2. Installed software. One question, four tables, because each OS stores the answer differently.

sql
SELECT name, version, publisher, install_date FROM programs;            -- Windows
SELECT name, bundle_short_version, bundle_identifier, path FROM apps;  -- macOS
SELECT name, version, arch FROM deb_packages;                          -- Debian, Ubuntu
SELECT name, version, release, arch FROM rpm_packages;                 -- RHEL family

3. Machines that haven't rebooted in 30 days, all platforms. Updates that need a restart can't finish on these until someone reboots.

sql
SELECT days, hours, minutes, total_seconds FROM uptime WHERE days >= 30;

Access and exposure

4. Local admins, all platforms. The group names are each OS's usual admin groups, so add your own if you rename them.

sql
SELECT u.username, u.uid, g.groupname
FROM users u
JOIN user_groups ug ON u.uid = ug.uid
JOIN groups g ON g.gid = ug.gid
WHERE g.groupname IN ('Administrators', 'admin', 'sudo', 'wheel');

5. What's listening on the network, and which process owns it. protocol comes back as a number: 6 is TCP, 17 is UDP.

sql
SELECT DISTINCT p.name, p.path, lp.port, lp.protocol, lp.address, p.pid
FROM listening_ports lp JOIN processes p ON lp.pid = p.pid
WHERE lp.port != 0 AND lp.address NOT IN ('127.0.0.1', '::1');

6. Browser extensions per user. The table covers Chromium browsers, including Chrome, Edge and Brave.

sql
SELECT u.username, ce.browser_type, ce.name, ce.identifier, ce.version, ce.permissions
FROM users u JOIN chrome_extensions ce USING (uid);

7. What starts at boot. startup_items works everywhere. autoexec adds the Windows view.

sql
SELECT name, path, type, source, status, username FROM startup_items;
SELECT name, path, source FROM autoexec;  -- Windows

Compliance checks

8. Disk encryption. protector_types arrived in 5.24.0, so older agents reject that column. filevault_status is a macOS-only column.

sql
SELECT drive_letter, protection_status, conversion_status, encryption_method, protector_types
FROM bitlocker_info;                                                    -- Windows
SELECT name, type, encrypted, encryption_status FROM disk_encryption;  -- macOS and Linux
SELECT name, encrypted, filevault_status FROM disk_encryption;         -- macOS

9. Windows patches. The patches table skips updates installed through MSI or downloaded from Windows Update. Its own schema says so, so check the update history too.

sql
SELECT hotfix_id, description, installed_on, installed_by FROM patches;
SELECT date, title, result_code FROM windows_update_history;

10. Security posture. There's no table named after Microsoft Defender. windows_security_products lists whatever antivirus Windows knows about, Defender included.

sql
SELECT firewall, antivirus, autoupdate, user_account_control FROM windows_security_center;
SELECT type, name, state, signatures_up_to_date FROM windows_security_products;
SELECT global_state, stealth_enabled, logging_enabled FROM alf;  -- macOS firewall

How IT teams use osquery day to day

Three jobs keep coming up. The first is audits and inventory. "Which machines still run Windows 10?" and "Who installed that remote access tool?" stop being a week of emails and become one query. For a sense of what to track and how often, see our endpoint visibility guide.

The second is compliance checks. A check is a query that returns rows when a device fails it: BitLocker off, firewall down, an admin account that shouldn't exist. Schedule it, and the log shows when a device drifts out of line and when it comes back.

The third is incident response. When a new threat report lands, you query every device for the file hash, process name or extension it names. The answer comes back in minutes. Practitioners lump this under threat hunting. This r/sysadmin list of free tools for small clients puts osquery next to Velociraptor for exactly that, and a reply adds Fleet to run it.

Running osquery on hundreds of devices

One osqueryi session doesn't scale. Across a fleet of machines, each agent needs a server that hands it a config, collects its logs and sends it live queries. osquery defines that server as a TLS API: devices enroll with a secret, then poll for config and queries. The osquery README lists four fleet managers that speak it: Fleet, Kolide, OSCTRL and Zentral.

Scale also turns agent settings into network settings. In June 2025, Ozon's security team wrote up four times osquery settings hurt their own infrastructure (in Russian, on Habr). In one case, failed log uploads retried for seven hours and pushed traffic to 4 Gbit/s against a 150 Mbit/s daily peak. The links to their sorting centers and warehouses went down.

Their fixes were all configuration. They capped retries with logger_tls_backoff_max, added in osquery 5.12.1. They moved live-query polling back to the 60-second default from 10 seconds. And they cut each agent's local log buffer from the default 1 million events to 60,000, about two hours of their events. Set those three before your first wide rollout.

Want to see the server side before you build it? This walkthrough deploys Fleet with Docker Compose, enrolls Linux hosts and runs live queries from the web UI.

Products built on osquery

You can run osquery with nothing but its own binaries and a log pipeline. Or you can let a vendor bring the server, the UI and the reports. Here's who builds on it and what they charge, as published in November 2026.

Fleet began as an osquery management server and grew into a full device manager. Its pricing page lists Free at $0 and Premium at $7 per host per month. At 100 devices, Premium comes to $700 a month. Premium adds things like zero-touch setup, disk-encryption enforcement, app deployment and multi-tenancy.

Our Fleet MDM review covers the Free and Premium split in detail.

Visibility isn't always the hard part. This r/macsysadmin thread comes from a 15-Mac shop that moved from Miradore to Fleet and hit a wall on software deployment. Fleet's cofounder replied in the thread and asked for a bug report.

Kolide became part of 1Password in February 2024 and now ships as 1Password Device Trust. Its support docs call osquery a central pillar of the product, used for device posture checks. The angle is sign-in: a laptop that fails a check can be blocked at login until the user fixes it.

CrowdStrike Falcon for IT runs osquery through the Falcon sensor you already deploy. The product page says it includes CrowdStrike-managed support for osquery and Python, so there's no second agent.

For what the module covers and what it leaves to your RMM, read our CrowdStrike Falcon for IT review.

Uptycs sells a managed osquery fleet as a service. Its Nexus page lists a starting price of $2 per endpoint per month in one place and $3 in another. Confirm the number before you budget.

Elastic's integration adds an osquery UI to Kibana on the free Basic tier. Wazuh and Velociraptor can both deploy and query osquery from their own agents.

What osquery doesn't do

osquery reads. It doesn't write. That one limit shapes how you use it.

• It can't fix what it finds. No script runs, no uninstall, no patch install.
• It has no remote control, file transfer or user chat.
• It isn't an EDR. It doesn't block a process or isolate a machine.
• Scheduled queries see snapshots. A process that starts and exits between two runs never shows up unless event tables are on.
• File monitoring differs by OS. Linux and macOS use file_events, while Windows uses ntfs_journal_events.

So osquery is half a workflow. It tells you the five laptops with BitLocker off. Something else has to turn BitLocker on.

Where OpenFrame fits

OpenFrame is Flamingo's open, AI-native infrastructure for IT and security, and osquery is part of it. Devices you manage in OpenFrame run osquery, so the queries above work without a separate server to stand up. Scheduled queries keep watch from the Monitoring section, and live queries answer on demand.

You don't have to write the SQL, either. Ask Mingo, OpenFrame's AI for technicians, "which Windows laptops have BitLocker off?" Before it writes a query, Mingo checks the osquery schema for that device's platform and installed osquery version. Then it shows you the SQL and waits for your approval before anything runs.

The answer is only half the job, and the other half sits in the same place. Mingo can run the fix as a script on those same devices through OpenFrame's built-in RMM. One chat covers the question, the query and the fix, with no second console to open.

You can self-host OpenFrame or run it on Flamingo's cloud. See how OpenFrame works and try it on a few of your own devices.

osquery in short

osquery answers questions about your devices in SQL, for free, on Windows, macOS and Linux. It reads and never writes, so its value depends on what you pair it with. Start with osqueryi and the ten queries above on one machine. Then pick how to run it at scale. Fleet fits if you want to host it yourself, and Falcon for IT if you already pay CrowdStrike. OpenFrame fits if you want the answer and the fix in one place.

Ask the question once in SQL, and stop asking it by email.