THM Room: Osquery: The Basics

Introduction

What?

Osquery converts the operating system (Windows, Linux, macOS, and FreeBSD) into a relational database.

Why?

To query an endpoint (or multiple endpoints) using SQL syntax.

How?

• Osquery shell

• Schema documentation

• Creating queries