osquery
Free · OSSHost & Endpoint
Ask your whole fleet a question in SQL — get an answer in seconds.
osquery homepage ↗Query your endpoints with SQL. "Show me every host where Chrome is older than version 130" returns in seconds. Persistence checks, software inventory, process tree — answers questions an EDR can't.
Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.
What it watches
- Scheduled-query diffs — new processes, listening ports, kernel modules
- Persistence checks (cron, launchd, services, autoruns)
- Software-inventory + patch-level drift
- Unexpected user/group + SSH-key changes
- File + registry monitoring via the query pack
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
4 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| osquery_added | Endpoint row added on osquery |
| osquery_removed | Endpoint row removed on osquery |
| osquery_snapshot | Endpoint snapshot on osquery |
| osquery_other | Endpoint query result on osquery |
What it helps you catch
What you'd see in CyberCLI
illustrativeAnswers 'which hosts have this IOC or this vulnerable package?' across the fleet in one query — the fastest scoping tool you have.
Routed to Warden (triage) → Knight (detection) → Scribe (record)
⛓ every step hash-chained · replayable
What CyberCLI reads from osquery
audit our mathosquery turns the endpoint into a queryable database — scheduled SQL queries return row-level results as NDJSON, one event per row. The 25 fields we read carry the envelope (query_name, host_id, action of added/removed/snapshot, query_counter/query_epoch for run lineage), operator decorations (env/role/dept), and stable columns lifted top-level — osquery_pid, osquery_path, osquery_cmdline, osquery_uid, osquery_username, osquery_sha256, osquery_target_path. Enough to answer what loaded, what changed in /etc, or who's listening on a port — without SSHing to the host.
Full field index · 25 fields ↓
.action.agent_name.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.event_id.event_time_raw.event_timestamp.event_type.host_id.osquery_cmdline.osquery_columns.osquery_decorations.osquery_path.osquery_pid.osquery_sha256.osquery_snapshot.osquery_target_path.osquery_uid.osquery_username.query_counter.query_epoch.query_name.rule_id MITRE techniques typically mapped
- T1057 ↗
Process DiscoveryDiscovery
- T1543.002 ↗
Create or Modify System Process: Systemd ServicePersistence · Privilege Escalation
- T1547.006 ↗
Kernel Modules and ExtensionsPersistence · Privilege Escalation
- T1053.003 ↗
Scheduled Task/Job: CronExecution · Persistence
- T1136 ↗
Create AccountPersistence
- T1049 ↗
System Network Connections DiscoveryDiscovery
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest row-level results, notify Herald on added rows for watched query packs (kernel modules, listening ports, scheduled tasks, new users), summarize the host-state delta for the case
- ·L3 (Knight verification): hash lookup on osquery_sha256, reputation check on osquery_path/osquery_cmdline, stitch added/removed pairs by query_epoch + query_counter into a single state-change story — read-only
- ·L4+: containment — osquery is read-only by design (no exec surface); killing a process, removing a kernel module, or quarantining a host routes through Wazuh-agent / EDR / firewall connectors
- ·Query-pack edits (osquery.conf, schedule changes) stay operator-owned — the AI never rewrites the policy it queries through
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/osquery/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
osquery covers 3 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Deploy osqueryd with a scheduled query pack to your hosts.
- 2 Ship results to the CyberCLI endpoint (TLS logger or file).
- 3 Run `cybercli onboard osquery`.
- 4 Confirm query results in the dashboard's Connectors panel.
curl -fsSL https://pkg.osquery.io/deb/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/osquery.gpg && sudo apt install osquery
Fully local. Queries run on your endpoints; results stay in your network.