skills.rest
AgentSecOps
AgentSecOpsOFFICIAL
Explore all skills by this author →
GitHub

forensics-osquery

Collect endpoint forensic artifacts using SQL-based osquery queries.

183|35|Updated Nov 19, 2025
Search Tags:#queries#endpoint#forensics#incident-response#dfir#threat-hunting#osquery
One-click install
npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill forensics-osquery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forensics-osquery
Source: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/forensics-osquery
Command: npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill forensics-osquery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Osquery-based investigations enable security teams to quickly collect and analyze endpoint evidence using SQL queries, reducing time-to-insight during incidents.

Core Features & Use Cases

  • SQL-based interrogation of processes, network connections, files, registry and persistence artifacts across Linux, macOS, and Windows.
  • Prebuilt triage and threat-hunting workflows with guided playbooks and MITRE ATT&CK mappings.
  • Use cases include rapid incident response, threat hunting, and post-incident forensic timeline construction.

Quick Start

Run the bundled triage script to collect forensic artifacts from the target endpoint and then execute the hunting workflow to map findings to MITRE techniques.

Frequently Asked Questions about forensics-osquery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect endpoint forensics artifacts using osquery for incident response?▼

Endpoint forensics with osquery allows security teams to quickly collect and analyze endpoint evidence using SQL queries, reducing time-to-insight during incidents across Linux, macOS, and Windows environments.

How do I query persistence mechanisms and registry artifacts during a DFIR investigation?▼

You query persistence and registry artifacts by executing SQL-based interrogation scripts against the target endpoint to identify forensic artifacts and map findings to MITRE ATT&CK techniques.

Does osquery work across Linux, macOS, and Windows for threat hunting?▼

Yes, osquery supports threat hunting across Linux, macOS, and Windows environments by using SQL queries to interrogate processes, network connections, files, and persistence artifacts consistently.

What is the best way to map endpoint forensic findings to MITRE ATT&CK techniques?▼

The best way to map findings is to execute the prebuilt threat-hunting workflow, which guides you through interrogating artifacts and aligning discovered evidence with known MITRE ATT&CK techniques.

Can I build a post-incident forensic timeline using osquery?▼

Yes, you can build a post-incident forensic timeline by collecting evidence through SQL-based queries and prebuilt packs, which gather and timeline endpoint artifacts for DFIR investigations.

When should I use SQL-based endpoint forensics instead of other incident response methods?▼

Use SQL-based endpoint forensics when you need to rapidly collect and analyze incident evidence across multiple operating systems, reducing time-to-insight by leveraging prebuilt triage workflows and structured queries.

Related Skills

Explore More Data & Analytics Skills→
BurburtonBurburton

Benchmark Analysis

Establish performance baselines and compare benchmark results across builds.

Community
Advanced
SherifEldeebSherifEldeeb
5

cloud-forensics

Analyze cloud forensic evidence across AWS, Azure, GCP, and M365.

Community
Intermediate
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
as4584as4584
2

memory-forensics

Analyzes volatile memory dumps using Volatility 3 to extract processes, networks, and artifacts.

Community
Advanced