-
Book Overview & Buying
-
Table Of Contents
SOC Analyst Career Guide
By :
Osquery is an operating system query framework for macOS, Linux, and Windows. It is built on SQL statements such as SQL databases and thus is transferable to databases and other applications that use SQL. In essence, Osquery treats the operating system as a relational database and is a viable alternative to other tools such as PsExec. It is installed by default in the Security Onion 2 Elastic agent.
Osquery is useful for incident response and incident management. For example, you need to quickly see what users are installed on a system, what processes are running, what programs are installed, and so on. Osquery can give you this information via simple SQL statements without having to manually connect to the host, obtain administrative access, and so on.
This can be useful in certain situations, such as when information may not have been logged into Security Onion 2 due to the action or verbosity level, or where the Elastic Defend agent may have been recently...