OSQuery Integration

SQL-based system inspection.

Overview

OSQuery lets you query system information using SQL syntax.

Usage

1. Select an agent in the dashboard
2. Navigate to Query tab
3. Enter SQL query
4. Execute and view results

Common Queries

Installed Software

-- Debian/Ubuntu
SELECT name, version FROM deb_packages;

-- RHEL/CentOS
SELECT name, version FROM rpm_packages;

-- Windows
SELECT name, version FROM programs;

-- macOS
SELECT name, bundle_version FROM apps;

Running Processes

SELECT pid, name, cmdline, cpu_time, resident_size
FROM processes
ORDER BY cpu_time DESC
LIMIT 10;

Open Network Connections

SELECT local_address, local_port, remote_address, remote_port, state
FROM process_open_sockets
WHERE state = 'ESTABLISHED';

Logged In Users

SELECT user, host, time, tty
FROM logged_in_users;

System Information

SELECT hostname, cpu_brand, physical_memory
FROM system_info;

Disk Space

SELECT path, type, blocks_size * blocks_available / 1024 / 1024 AS free_mb
FROM mounts;

Scheduled Queries

Run queries on a schedule:

1. Navigate to Admin → Scheduled Queries
2. Create new query
3. Set schedule (cron format)
4. Select target agents