osquery

What it is

Scheduled queries turn tables such as processes, sockets, and file hashes into JSON logs. A Linux Foundation project maintains it. It runs on Linux, macOS, and Windows.

What it helps with

- Asking SQL questions about processes, network connections, and file hashes on a host
- Running named query packs on a schedule, including incident-response packs
- Sending added and removed rows into a log pipeline

Who it's for

Detection engineers who want host state as query results rather than another agent console. The project itself is the local agent and daemon.

Worth knowing

File integrity events can be turned on in the config. Current macOS support starts at macOS 10.15. The project does not sell a paid edition. Separate companies sell fleet managers around it.

What license is it under?
You can use it under Apache 2.0 or GPL 2.0. Both are OSI-approved.

Who maintains it?
A Linux Foundation project maintains it, with a technical steering committee.

Does the daemon log every row every time?
No. It can log only added and removed rows, or a full snapshot.