AppBreakup
Submit an app
osquery logo

osquery

Open-source agent that lets you query a computer's processes, users, files and more with SQL.

Open sourceSelf-hostableMonitoring and error tracking tools
Visit osquerySee 4 alternatives
Verified facts
4 of 4
Alternatives ranked
4
Approved reviews
0
Visits sent from here
0

About osquery

osquery turns an operating system into something you can query like a database. Running processes, logged-in users, open network ports, installed packages, browser extensions, startup items and file hashes all appear as SQL tables, so a question like 'which processes are listening on every interface?' becomes a short SELECT. It comes in two parts: osqueryi, an interactive shell for ad-hoc questions and incident response, and osqueryd, a daemon that runs scheduled queries and logs changes over time across a whole fleet of machines. It runs on Linux, macOS and Windows and is used mostly by security and IT operations teams. osquery itself has no dashboard or central server; to manage many hosts you pair it with a fleet manager such as Fleet or Kolide, or ship its logs to your existing pipeline. It's free and open source, dual-licensed under Apache 2.0 and GPL 2.0.

Best for: Security and IT teams who want SQL-level visibility into every laptop and server..

Pros and cons

What works

  • Plain SQL for questions about processes, users, ports, packages and files
  • Same agent and tables on Linux, macOS and Windows
  • Scheduled queries and logs show changes across a whole fleet
  • Free, open source, with a plugin and extension API

Why people leave

  • No built-in dashboard or central management; needs a separate fleet manager
  • Writing useful queries takes SQL skills and knowledge of the table schema
  • Detection rules and alerting are up to you to build

Top osquery alternatives

See all 4
  1. 1Wazuh logo
    Wazuh

    Open-source security platform with a central server, dashboards and ready-made detection rules on top of its own agent.

    66.5
  2. 2Elastic Observability logo
    Elastic Observability

    Elastic's agent collects host data into a hosted search and dashboard stack, with less SQL to write.

    64.8
  3. 3Zabbix logo
    Zabbix

    Open-source host monitoring with a central server and alerting, better for uptime and performance than security.

    61.8
  4. 4Netdata logo
    Netdata

    Easier real-time host metrics with dashboards out of the box, focused on performance rather than security state.

    59.4

Why people left osquery

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from osquery, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of osquery
Your rating of osquery

Never shown publicly. A work email helps us verify you.

What did you use it for, and what was good or bad? At least 40 characters.

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

osquery: common questions

Is osquery free?

Yes. osquery is free, open-source software that you can host yourself.

Is osquery open source?

Yes. The source code is on GitHub at osquery/osquery. You can also run it on your own server.

What platforms does osquery run on?

osquery is available for Linux, macOS, Windows and Self-hosted.

What are the best alternatives to osquery?

The highest-ranked osquery alternatives right now are Wazuh, Elastic Observability and Zabbix. See the full ranked list for pricing, platforms and verified facts.

See all 4 osquery alternatives