deploying-osquery-for-endpoint-monitoring

Install the osquery package for your OS from osquery.io, then create an osquery.conf defining scheduled SQL queries for processes, ports, and persistence. Enable the events framework and point logs at /var/log/osquery for collection.

Use SQL against osquery tables such as processes, listening_ports, crontab, and startup_items. For example, SELECT pid, name, path FROM processes WHERE on_disk = 0 detects fileless malware running without an on-disk binary.

Yes, osquery runs on all three platforms with OS-specific installers: MSI for Windows, brew for macOS, and deb/rpm packages for Linux. Some tables like authenticode are Windows-only, while deb_packages is Linux-specific.

Tables like process_events and socket_events return nothing unless events are enabled with --disable_events=false and the audit publisher is active with --disable_audit=false. On Linux, osquery must own auditd, which conflicts with a running auditd or auditbeat service.

Osquery is the endpoint agent that exposes OS state as SQL tables, while FleetDM is a central management server that handles agent enrollment, query distribution, and result aggregation across a fleet using TLS-secured connections.

Osquery runs queries periodically or on demand, so it is not suited for real-time alerting or blocking. Use a dedicated EDR solution when you need immediate detection and response rather than scheduled visibility.