Osquery: The Basics
Let's cover the basics of Osquery.
easy
To access material, start machines and answer questions login.
Osquery (opens in new tab) is an open-source (opens in new tab) monitoring agent created by Facebook in 2014. It converts the operating system into a relational database and allows us to ask questions from the tables using queries, like returning the list of running processes, a user account created on the host, and the process of communicating with certain suspicious domains. It is widely used by Security Analysts, Incident Responders, Threat Hunters, etc. Osquery can be installed on multiple platforms: Windows, , macOS, and FreeBSD.
Learning Objectives
- Learn what is Osquery, and what problem it solves
- Discover OSquery for , and security teams
- Explore Osquery usage in interactive () mode
- Dive deeper into table joins and complex queries
Note: It is highly beneficial if you're already familiar with SQL queries. If not, check out this SQL Tutorial (opens in new tab).
Move on to the next task!
Ready to learn Cyber Security?
The Osquery: The Basics room is only available for Premium or Max subscribers. Signup now to access more than 500 free rooms and learn cyber security through a fun, interactive learning environment.
Already have an account? Log in