Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.
Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With Osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
While many endpoint security agents collect ongoing and streaming data such as process creation and file modification, Osquery allows you to take a “point in time” examination about the state of your devices which makes searching for anomolies and outliers more straightforward. Osquery is able to introspect into many areas in the operating system, and using JOINs, it allows you to gather quite a bit of context with a single query.