EDR/XDROpen source · Apache-2.0 OR GPL-2.0
osquery
Community project
Exposes an operating system's processes, sockets, and configuration as SQL tables you can query, on Windows, macOS, and Linux. Created at Facebook and now governed by the OSQuery Foundation under the Linux Foundation, it is a building block embedded inside many commercial EDR and fleet-visibility products.
- Product type
- Community project
- Deployment
- AgentCLI
- Organization size
- Mid-marketEnterprise
- Pricing tier
- Free
How osquery measures up against the full Endpoint & Extended Detection and Response taxonomy.
- Behavioral detection — not supported
- Flags malicious behavior patterns rather than known file signatures.
- Threat hunting — supported
- Lets analysts query historical endpoint telemetry for signs of compromise.
- Remote response actions — not supported
- Isolate a host, kill a process, or pull files from an endpoint remotely.
- Ransomware rollback — not supported
- Restores files encrypted or modified by detected ransomware.
- Cross-surface correlation (XDR) — not supported
- Correlates endpoint signals with identity, email, and cloud telemetry.
- Managed detection option — not supported
- Vendor-operated 24/7 monitoring available (MDR).
Alternatives
Other Endpoint & Extended Detection and Response tools with overlapping capabilities, sized for similar teams.
Appears in stacks
Real-world stacks that include osquery.