We stand with Ukraine to help keep people safe. Join us
osquery free download for Mac


Version 5.2.2

Query your devices like a database.

FreeAbsolutely Free

osquery overview

Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

Processes running without a binary on disk

Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

Three things you should know about osquery
  • It's fast and tested: Our build infrastructure ensures that newly introduced code is benchmarked and tested. We perform continuous testing for memory leaks, thread safety, and binary reproducibility on all supported platforms.
  • It runs everywhere: Windows, macOS, CentOS, FreeBSD, and almost every Linux OS released since 2011 are supported with no dependencies. osquery powers some of the most demanding companies, including Facebook.
  • It's open source: Osquery is released under the Apache License. Ever since we open-sourced it in 2014, organizations and individuals have contributed an ever-growing list of impressive features, useful tools, and helpful documentation.

What’s new in version 5.2.2

Updated on Apr 07 2022

  • Osquery 5.2.2 brings native Apple Silicon (M1) support to the macOS platform. It also represents a comprehensive review and update of our third-party dependencies. To support this work, the developer docs have been updated, as have several parts of the build system
  • This release represents commits from 24 contributors! Thank you all.
  • Apple Silicon support (#7330)
  • The cpuid table is x86 only. See #7462
  • The smart_drive_info table has been deprecated, and is not included in the m1 builds. See #7464
  • The lldp_neighbors table has been deprecated, and is not included in the m1 builds. See #7463
  • Update time table to always reflect UTC values (#7276, #7460, #7437)
  • Hide the deprecated antispyware column in windows_security_center (#7411)
  • Add windows_firewall_rules table for windows (#7403)
  • Update the ATC table path column check to be case insensitive (#7442)
  • Fix a crash introduced by 5.2.0 when Yara uses its own strutils functions (#7439)
  • Fix user_time and system_time unit in processes table on M1 (#7473)
  • Fix typos in documentation (#7443, #7412)
  • CHANGELOG 5.1.0 (#7406)
  • Update sqlite to version 3.37.0 (#7426)
  • Fix linking of thirdparty_sleuthkit (#7425)
  • Fix how we disable tables in the fuzzer init method (#7419)
  • Prevent running discovery queries when fuzzing (#7418)
  • Add BOOST_USE_ASAN define when enabling Asan (#7469)
  • Removing unnecessary macOS version check (#7451)
  • Fix submodule cache for macOS CI runner (#7456)
  • Add osquery version to macOS app bundle Info.plist (#7452)
  • libs: Update OpenSSL to verion 1.1.1l (#7330)
  • libs: Update augeas to version 1.12.0 (#7330)
  • libs: Update aws-sdk to version 1.9.116 (#7330)
  • libs: Update boost to version 1.77 (#7330)
  • libs: Update gflags to 2.2.2 (#7330)
  • libs: Update glog to version 0.5.0 (#7330)
  • libs: Update googletest to version 1.11.0 (#7330)
  • libs: Update libarchive to version 3.5.2 (#7330)
  • libs: Update libcap to version 1.2.59 (#7330)
  • libs: Update libmagic to version 5.40 (#7330)
  • libs: Update librdkafka to version 1.8.0 (#7330)
  • libs: Update libxml2 to version 2.9.12 (#7330)
  • libs: Update linenoise-ng to the latest commit (#7330)
  • libs: Update lzma to version 5.2.5 (#7330)
  • libs: Update rocksdb to version 6.22.1 (#7330)
  • libs: Update sleuthkit to version 4.11.0 (#7330)
  • libs: Update ssdeep-cpp to the latest commit (d8705da) (#7330)
  • libs: Update thrift to version 0.15.0 (#7330)
  • libs: Update yara to version 4.1.3 (#7330)
  • libs: Update zstd to version 1.4.0 (#7330)





24.2 MB

Developer’s website




App requirements

  • Intel 64
  • Apple Silicon
  • OS X 10.9.0 or later
Try our new feature and write a detailed review about osquery. All reviews will be posted soon.
Write your thoughts in our old-fashioned comment
MacUpdate Comment Policy. We strongly recommend leaving comments, however comments with abusive words, bullying, personal attacks of any type will be moderated.
(0 Reviews of )
There are no reviews yet
Help the community
There are no reviews yet, be the first to leave one
FreeAbsolutely Free
How would you rate osquery?
Similar apps
Manage multiple databases from a single application.
Is this app is similar to RazorSQL? Vote to improve the quality of this list.
Vote results
Total score
Universal database query and editor tool.
Is this app is similar to DtSQL? Vote to improve the quality of this list.
Vote results
Total score