Osquery: An sqlite3 virtual table exposing operating system data to SQL

osquery is a cool project, with a lot of outstanding issues. It has a great deal of technical debt, including performance and security debts that don't receive adequate attention. It also has a huge user community around it, but only a handful of active recurring contributors and companies actually funding development on it (and, even then, the bulk of the development is feature work rather than debt burndown). (Source: I worked on osquery's core and tables for 2-3 years for…

I realize WMI[1] is a Windows-thing only, but if you're already on the Windows-platform, WMI comes shipped out of the box and has been for probably a decade or more, and is overall very well supported. It has its quirks, but there's practically no part of the system you shouldn't be able to get information about using WQL[2]. [1] https://msdn.microsoft.com/en-us/library/ms186146(vs.80).asp... [2] https://en.m.wikipedia.org/wiki/WQL

Kinda shocked I have never heard of this before today. Seems very handy, especially for people deploying x-platform desktop apps or scripts. It is a SQL abstraction over OS information, kind of the SQL equivalent of the info you could glean by inspecting properties on the Python `os` module, and perhaps many OS/device details besides.

What is osquery? osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.