osquery review 2026: the open-source SQL framework for OS instrumentation and security monitoring. Features, governance, pricing and top alternatives.
osquery is an open-source framework that turns an operating system into a queryable relational database, letting security and IT teams run SQL queries against low-level system state such as running processes, installed packages, users, and network connections. It was originally built and open-sourced by Facebook in 2014.
In 2019, governance of the project moved from Facebook to the newly formed OSquery Foundation under the Linux Foundation, making it a vendor-neutral, community-governed project overseen by a Technical Steering Committee with representatives from companies including Meta, Trail of Bits, Google, and Kolide.
osquery ships with two primary tools: osqueryi, an interactive SQL shell for exploring system state, and osqueryd, a lightweight daemon that runs scheduled queries across a fleet of machines and logs state changes over time. Its schema exposes more than 280 tables covering hardware, software, and OS-level events.
The project supports Windows, macOS, and major Linux distributions, and is extensible through custom tables and extensions. Because osquery itself does not include a management dashboard, it is commonly deployed alongside a fleet-management layer such as Fleet or Kolide.
osquery itself is completely free and open source, dual-licensed under Apache 2.0 and GPLv2, with no paid tiers, subscriptions, or licensing fees for the core project.
Organizations that want a management UI, alerting, or fleet deployment tooling on top of osquery typically adopt a separate product, such as the open-source Fleet platform or the commercial Kolide device-trust platform, which carry their own independent pricing.
Yes, osquery is completely free and open source, dual-licensed under Apache 2.0 and GPLv2, with no paid tiers for the core project itself.
osquery was created by Facebook and publicly released as open source on October 29, 2014. Governance later transferred to the vendor-neutral OSquery Foundation under the Linux Foundation in 2019.
osqueryi is an interactive SQL shell for running ad hoc queries against system state, while osqueryd is a background daemon that runs scheduled queries across a fleet of machines and logs changes over time.
No, osquery itself is a query engine and daemon without a built-in fleet dashboard. Most organizations pair it with a separate tool like Fleet or Kolide for fleet-wide management and alerting.
osquery supports Windows, macOS, and major Linux distributions such as Ubuntu and CentOS, with a schema of over 280 tables covering hardware, software, and OS events.
osquery is governed by the OSquery Foundation, a project under the Linux Foundation, directed by a Technical Steering Committee with members from companies including Meta, Trail of Bits, Google, and Kolide.
osquery has been used in production by companies including Airbnb, Dropbox, Netflix, Etsy, Uber, and Palantir for security monitoring and infrastructure visibility.
Common alternatives and complements include Wazuh, Fleet, Kolide, and commercial EDR platforms like CrowdStrike Falcon and SentinelOne.