Osquery = query OS seperti database.
Key Tables
| Table | Purpose |
|---|---|
| processes | Running apps |
| listening_ports | Network listeners |
| socket_events | Network connections |
| file_events | File changes |
| users | User accounts |
| services | Running services (Windows) |
Example Queries
-- Suspicious processes
SELECT * FROM processes
WHERE path LIKE '/tmp/%' OR name LIKE '%mal%';
-- Unusual network listeners
SELECT * FROM listening_ports
WHERE port NOT IN (80, 443, 22, 3306);