Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based
Instrucciones de origen · Vista previa de solo lectura
name
cyber-deploying-osquery-for-endpoint-monitoring
description
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based
source
mukul975/Anthropic-Cybersecurity-Skills
license
Apache-2.0
authorized_lab
false
origin_frontmatter
name: deploying-osquery-for-endpoint-monitoring | description: 'Deploys and configures osquery for real-time endpoint monitoring using | SQL-based queries to inspect running processes, open ports, installed software, | and system configuration. Use when building visibility into endpoint state, threat | hunting across fleet, or implementing compliance monitoring. Activates for requests | involving osquery deployment, endpoint visibility, fleet management, or SQL-based | endpoint queryin
hide
true
Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.
Deploying Osquery for Endpoint Monitoring
When to Use
Use this skill when:
Deploying osquery across Windows, macOS, and Linux endpoints for fleet-wide visibility
Building threat hunting queries using osquery's SQL interface
Monitoring endpoint compliance (installed software, open ports, running services)
Integrating osquery data with SIEM or Kolide/Fleet for centralized management
Do not use for real-time alerting (osquery is periodic/on-demand; use EDR for real-time).
// /etc/osquery/osquery.conf (Linux/macOS) or C:\ProgramData\osquery\osquery.conf{"options":{"config_plugin":"filesystem","logger_plugin":"filesystem","logger_path"
:
"/var/log/osquery"
,
"disable_logging"
:
"false"
,
"schedule_splay_percent"
:
"10"
,
"events_expiry"
:
"3600"
,
"verbose"
:
"false"
,
"worker_threads"
:
"2"
,
"enable_monitor"
:
"true"
,
"disable_events"
:
"false"
,
"disable_audit"
:
"false"
,
"audit_allow_config"
:
"true"
,
"host_identifier"
:
"hostname"
,
"enable_syslog"
:
"true"
}
,
"schedule"
:
{
"process_monitor"
:
{
"query"
:
"SELECT pid, name, path, cmdline, uid, parent FROM processes WHERE on_disk = 0;"
,
"interval"
:
300
,
"description"
:
"Detect processes running without on-disk binary (fileless)"
}
,
"listening_ports"
:
{
"query"
:
"SELECT DISTINCT p.name, p.path, lp.port, lp.protocol, lp.address FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.port != 0;"
,
"interval"
:
600
,
"description"
:
"Monitor listening network ports"
}
,
"persistence_check"
:
{
"query"
:
"SELECT name, path, source FROM startup_items;"
,
"interval"
:
3600
,
"description"
:
"Monitor persistence mechanisms"
}
,
"installed_packages"
:
{
"query"
:
"SELECT name, version, source FROM deb_packages;"
,
"interval"
:
86400
,
"description"
:
"Daily software inventory"
}
,
"users_and_groups"
:
{
"query"
:
"SELECT u.username, u.uid, u.gid, u.shell, u.directory FROM users u WHERE u.uid >= 1000;"
,
"interval"
:
3600
}
,
"crontab_monitor"
:
{
"query"
:
"SELECT * FROM crontab;"
,
"interval"
:
3600
,
"description"
:
"Monitor scheduled tasks"
}
,
"suid_binaries"
:
{
"query"
:
"SELECT path, username, permissions FROM suid_bin;"
,
"interval"
:
86400
,
"description"
:
"Detect SUID binaries"
}
}
,
"packs"
:
{
"incident-response"
:
"/usr/share/osquery/packs/incident-response.conf"
,
"ossec-rootkit"
:
"/usr/share/osquery/packs/ossec-rootkit.conf"
,
"vuln-management"
:
"/usr/share/osquery/packs/vuln-management.conf"
}
}
Step 3: Threat Hunting Queries
-- Detect processes with no on-disk binary (potential fileless malware)SELECT pid, name, path, cmdline FROM processes WHERE on_disk =0;
-- Find listening ports not associated with known servicesSELECT lp.port, lp.protocol, p.name, p.path
FROM listening_ports lp JOIN processes p ON lp.pid = p.pid
WHERE lp.port NOTIN (22, 80, 443, 3306, 5432);
-- Detect unauthorized SSH keysSELECT*FROM authorized_keys WHERENOT key LIKE'%admin-team%';
-- Find recently modified system binariesSELECT path, mtime, size FROM file
WHERE path LIKE'/usr/bin/%'AND mtime > (strftime('%s', 'now') -86400);
-- Detect processes connecting to external IPsSELECTDISTINCT p.name, p.path, pn.remote_address, pn.remote_port
FROM process_open_sockets pn JOIN processes p ON pn.pid = p.pid
WHERE pn.remote_address NOTLIKE'10.%'AND pn.remote_address NOTLIKE'172.16.%'AND pn.remote_address NOTLIKE'192.168.%'AND pn.remote_address !='127.0.0.1'AND pn.remote_address !='0.0.0.0';
-- Windows: Detect unsigned running executablesSELECT p.name, p.path, a.result AS signature_status
FROM processes p JOIN authenticode a ON p.path = a.path
WHERE a.result !='trusted';
Step 4: Deploy FleetDM for Centralized Management
# FleetDM provides centralized osquery management# Deploy FleetDM server, configure agents to report to it# Agents use TLS enrollment and config from Fleet# Agent configuration for Fleet:# --tls_hostname=fleet.corp.com# --tls_server_certs=/etc/osquery/fleet.pem# --enroll_secret_path=REDACTED_EXAMPLE_VALUE
Key Concepts
Term
Definition
Osquery
Open-source endpoint agent that exposes OS state as SQL tables for querying
Schedule
Periodic queries that run at defined intervals and log results
Pack
Collection of related queries grouped for specific use cases (IR, compliance)
FleetDM
Open-source osquery fleet management platform
Differential Results
Osquery logs only changes between query executions, reducing data volume
