{"id":51729,"url":"https://github.com/sttor/awesome-osquery","name":"awesome-osquery","description":"Osquery Resources","projects_count":43,"last_synced_at":"2026-07-15T15:00:30.459Z","repository":{"id":61489177,"uuid":"203984147","full_name":"sttor/awesome-osquery","owner":"sttor","description":"Osquery Resources","archived":false,"fork":false,"pushed_at":"2019-08-23T13:27:45.000Z","size":11,"stargazers_count":64,"open_issues_count":0,"forks_count":13,"subscribers_count":4,"default_branch":"master","last_synced_at":"2026-06-10T06:01:09.075Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sttor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-08-23T11:17:43.000Z","updated_at":"2026-03-30T04:32:20.000Z","dependencies_parsed_at":"2022-10-19T22:15:21.571Z","dependency_job_id":null,"html_url":"https://github.com/sttor/awesome-osquery","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sttor/awesome-osquery","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sttor%2Fawesome-osquery","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sttor%2Fawesome-osquery/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sttor%2Fawesome-osquery/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sttor%2Fawesome-osquery/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sttor","download_url":"https://codeload.github.com/sttor/awesome-osquery/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sttor%2Fawesome-osquery/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34844346,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-27T02:00:06.362Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-14T11:16:28.045Z","updated_at":"2026-07-15T15:00:30.459Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Blogs and Articles","Courseware","Commercial Fleet Manager","Repository","Opensource Fleet Manager"],"sub_categories":["MITRE ATT\u0026CK"],"readme":"# Awesome Osquery\nCurated List of osquery resources.\n\n\n## Downloads\n* [Official Osquery Repository](https://osquery.io/downloads/official/3.3.2)\n\n## Blogs and Articles\n\n#### Official Documentation\n* [Documentation](https://osquery.readthedocs.io/en/latest/)\n\n#### Starter Guide\n* How to monitor your System Security with osquery - Digitalocean - [link](https://www.digitalocean.com/community/tutorials/how-to-monitor-your-system-security-with-osquery-on-ubuntu-16-04)\n* Server Endpoint Security with osquery - Alibaba Cloud - [link](https://www.alibabacloud.com/blog/server-endpoint-security-with-osquery_594950)\n* Osquery For Security Part 1 - [link](https://medium.com/@clong/osquery-for-security-b66fffdf2daf)\n* Osquery For Security Part 2 - [link](https://medium.com/@clong/osquery-for-security-part-2-2e03de4d3721)\n* Osquery across the enterprise - [link](https://medium.com/palantir/osquery-across-the-enterprise-3c3c9d13ec55)\n* Install/Setup Doorman + Osquery on Windows, MAC OSX and Linux Deployment. - [link](https://holdmybeersecurity.com/2017/08/17/installsetup-doorman-osquery-on-windows-mac-osx-and-linux-deployment/#comment-10468)\n\n#### ELK\n* Attack Monitoring Using ELK and osquery - [link](http://www.prajalkulkarni.com/2016/05/attack-monitoring-using-elk-outofband.html)\n* Elk + Osquery + Kolide Fleet = Love  - [link](https://jordanpotti.com/2018/02/16/elk-osquery-kolide-fleet-love/)\n\n#### Remote Forensics \u0026 Threat Hunting\n* Using osquery for remote forensics - TrailofBits- [link](https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics/)\n* Introduction to osquery for Threat Detection and DFIR - Rapid7 - [link](https://blog.rapid7.com/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/)\n* Threat Hunting with Kolide and osquery - [link](https://resources.infosecinstitute.com/category/enterprise/threat-hunting/threat-hunting-solutions/how-to-build-a-threat-hunting-tool-in-10-steps/threat-hunting-with-kolide-and-osquery/#gref)\n\n\n#### Malware Analysis\n* Malware Analysis using Osquery | Part 1 - [link](https://hackernoon.com/malware-analysis-using-osquery-part-1-78f5f617cc19)\n* Malware Analysis using Osquery | Part 2 - [link](https://hackernoon.com/malware-analysis-using-osquery-part-2-69f08ec2ecec)\n* Malware Analysis using Osquery | Part 2 - [link](https://hackernoon.com/malware-analysis-using-osquery-part-3-9dc805b67d16)\n* MAC Malware Analysis using Osquery - Uptycs - [link](https://www.uptycs.com/blog/malware-analysis-using-osquery)\n* Malware Hunting made easy with osquery and extensions [link](https://medium.com/@atul_15222/malware-hunting-made-easy-with-osquery-and-extensions-64361abac667)\n* Detecting Malicious downloads with osquery, rsyslog, kafka, python3 and virustotal. - [link](https://holdmybeersecurity.com/2019/04/25/detecting-malicious-downloads-with-osquery-rsyslog-kafka-python3-and-virustotal/)\n\n### MITRE ATT\u0026CK\n* [ATT\u0026CK+osquery = love](https://www.carbonblack.com/2018/10/29/attck-osquery-love/)\n* [Hardening defenses with MITRE ATT\u0026CK and osquery: Lessons from Singapore Health Breach](https://www.uptycs.com/blog/hardening-defenses-with-mitre-attck-and-osquery-lessons-from-singapore-health-breach)\n\n#### Other\n* Manage Santa within osquery - TrailofBits - [link](https://blog.trailofbits.com/2018/05/29/manage-santa-within-osquery/)\n* Anomaly detection using osquery - Facebook  - [link](https://es-la.facebook.com/notes/protect-the-graph/anomaly-detection-using-osquery/1532788613627951/)\n* Logging Osquery with rsyslog - [link](https://holdmybeersecurity.com/2019/03/29/logging-osquery-with-rsyslog-v8-love-at-first-sight/)\n* Deploying osquery at scale - Uptycs - [link](https://www.uptycs.com/blog/deploying-osquery-at-scale-a-comprehensive-list-of-open-source-tools)\n* Building and effective EDR with osquery [link](https://medium.com/@atul_15222/building-an-effective-edr-f8b1b037d6da)\n* Adobe's Hubble and Osquery - [link](https://blogs.adobe.com/security/2017/12/introducing-hubblestack.html)\n* How are teams currently using osquery -[link](https://blog.trailofbits.com/2017/11/09/how-are-teams-currently-using-osquery/)\n* Osquery Cheat Sheet – Process Interrogation \u0026 Persistence Techniques - [link](https://defensivedepth.com/2018/10/10/osquery-cheat-sheet-process-interrogation-persistence-techniques/)\n\n\n## Courseware\n* Free - Osquery training by Uptycs - [link](https://www.uptycs.com/free-osquery-training-intro-to-osquery)\n* Paid - Osquery for Security Analysis - [link](https://www.networkdefense.io/library/osquery-for-security-analysis/71832/about/)\n\n## Repository \n* A repository for using osquery for incident detection and response. [osquery-configuration](https://github.com/palantir/osquery-configuration)\n* Python Binding for osquery [osquery-python](https://github.com/osquery/osquery-python)\n* Go Binding for osquery [osquery-go](https://github.com/kolide/osquery-go)\n* Mapping the MITRE ATT\u0026CK Matrix with Osquery [osquery-attck](https://github.com/teoseller/osquery-attck)\n\n## Opensource Fleet Manager\n* [Doorman](https://github.com/mwielgoszewski/doorman)\n* [Kolide Fleet](https://github.com/kolide/fleet)\n* [Zentral](https://github.com/zentralopensource/zentral/wiki)\n* [Okta - SGT: OSQuery Management Server Built Entirely on AWS!](https://github.com/OktaSecurityLabs/sgt)\n\n## Commercial Fleet Manager\n* [Kolide](https://kolide.com/)\n* [Sttor](https://sttor.com)\n* [Uptycs](https://www.uptycs.com/)\n* [Zercurity](https://www.zercurity.com/)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/sttor%2Fawesome-osquery/projects"}