deploying-osquery-for-endpoint-monitoring

name	deploying-osquery-for-endpoint-monitoring
description	Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","osquery","endpoint-monitoring","threat-hunting","fleet-management"]
mitre_attack	["T1547","T1049","T1620","T1053.003","T1548.001","T1552"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Deploying Osquery for Endpoint Monitoring

When to Use

Use this skill when:

• Deploying osquery across Windows, macOS, and Linux endpoints for fleet-wide visibility
• Building threat hunting queries using osquery's SQL interface
• Monitoring endpoint compliance (installed software, open ports, running services)
• Integrating osquery data with SIEM or Kolide/Fleet for centralized management

Do not use for real-time alerting (osquery is periodic/on-demand; use EDR for real-time).

Common Misconfigurations & Verification

• Packs declared but never scheduled: a "packs" entry pointing to a missing/unreadable path is silently skipped — check SELECT name, interval FROM osquery_schedule; and SELECT * FROM osquery_packs; on the endpoint to confirm queries are actually loaded and running.
• Event tables empty because events are off: process_events, socket_events, and file_events return nothing unless --disable_events=false AND the audit publisher is on (--disable_audit=false, --audit_allow_config=true). On Linux confirm osquery owns auditd (it conflicts with a running auditd/auditbeat).
• Scope too narrow / WHERE filters out hits: the fileless query WHERE on_disk = 0 and the uid >= 1000 user query miss kernel-spawned or service-account activity. Validate WHERE clauses against a known-positive before trusting a clean result.
• Fleet enrollment or result logging broken: confirm hosts appear in FleetDM and that /var/log/osquery/osqueryd.results.log is filling; an enrolled host with no results log forwards nothing. Differential mode logs only a baseline on first run.
• Verify end-to-end: trigger a watched condition (open a listening port, add a crontab/Run-key per Atomic Red Team T1547/T1053) and confirm the scheduled query emits a row to the results log and into the SIEM at the next interval.

Prerequisites

• Osquery package for target OS (https://osquery.io/downloads)
• Fleet management server (Kolide Fleet or FleetDM) for enterprise deployment
• TLS certificates for secure agent-to-server communication
• Log aggregation pipeline (Filebeat, Fluentd) for osquery result logs