osquery
osquery
4.8.0
0.0
0.0
osquery free download for Mac

osquery for Mac4.8.0

15 June 2021

Query your devices like a database.

What is osquery for Mac

Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

Processes running without a binary on disk

Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

Three things you should know about osquery
  • It's fast and tested: Our build infrastructure ensures that newly introduced code is benchmarked and tested. We perform continuous testing for memory leaks, thread safety, and binary reproducibility on all supported platforms.
  • It runs everywhere: Windows, macOS, CentOS, FreeBSD, and almost every Linux OS released since 2011 are supported with no dependencies. osquery powers some of the most demanding companies, including Facebook.
  • It's open source: Osquery is released under the Apache License. Ever since we open-sourced it in 2014, organizations and individuals have contributed an ever-growing list of impressive features, useful tools, and helpful documentation.

What's new in osquery

Version 4.8.0:
New Features:
  • shell: Add .connect meta command (#6944)
Table Changes:
  • Add seccomp_events table for Linux (#7006)
  • Add shortcut_files table for Windows (#6994)
Under the Hood improvements:
  • Removing Keyboard Event Taps from osx-attacks pack (#7023)
  • Refactor watcher out of singleton pattern (#7042)
  • Small events subscriber refactor to increase test coverage (#7050)
  • Setting non-required deb_packages fields as optional in test (#7001)
Bug Fixes:
  • Handle events optimization edge cases (#7060)
  • Fix optimization for multiple queries using the same subscriber (#7055)
  • Use epoch and counter for events-based queries (#7051)
  • Guard node key to prevent duplicate enrollments (#7052)
  • Change windows calculation for physical_memory (#7028)
  • Free using WTSFreeMemoryEx for WTSEnumerateSessionsExW (#7039)
  • Release variable in Windows data conversation (#7024)
  • Change chrome_extensions warnings to verbose (#7032)
  • Add transactions to the SQLite authorizer PRAGMAs (#7029)
  • Change Windows messages to verbose (#7027)
  • Fix scheduler to print the correct number of elapsed seconds (#7016)
Documentation:
  • Fix tls_enroll_max_attempts flag name in the documentation (#7049)
  • Improve docs on FIM, mention NTFS and Audit, etc. (#7036)
  • config: Add docs for the events top-level-key (#7040)
  • Add funding link on GitHub generated page (#7043)
  • Correct the example in the windows_events table spec (#7035)
  • Correct docs about OpenSSL and TLS behavior (#7033)
  • Update docs to describe how to build for aarch64/arm64 (#6285) (#6970)
  • Add a note on enabling Windows to build with CMake's long paths (#7010)
  • Add 4.8.0 CHANGELOG (#7057)
Build:
  • Add an option to enable incremental linking on Windows (#7044)
  • Remove Buck leftovers that supported building with old versions of OpenSSL (#7034)
  • Add build_aarch64 workflow for push (#7014)
  • Move CI to using docker from osquery (#7012)
  • Update dockerfile to multiplatform (#7011)
  • Run GH Actions workflows on all tags (#7004)
  • Disable BPF events tests if OSQUERY_BUILD_BPF is false (#7002)
  • libs: Update OpenSSL to version 1.1.1k (#7026)
Try our new feature and write a detailed review about osquery. All reviews will be posted soon.
Write your thoughts in our old-fashioned comment
MacUpdate Comment Policy. We strongly recommend leaving comments, however comments with abusive words, bullying, personal attacks of any type will be moderated.
0.0
(0 Reviews of )
There are no reviews yet
Help the community
There are no reviews yet, be the first to leave one
Free
0.0
0.0
App requirements: 
  • Intel 64
  • OS X 10.9.0 or later
License: 
FreeAbsolutely Free

Downloaded & Installed 61 times

How would you rate osquery?
Similar apps
Be the first one to propose an app
similar to osquery.