Earlier this week, Facebook aounced that it is bringing its Osquery to Windows. The company launched Osquery back in 2014 for macOS and Linux, but it is finally bringing it to Windows devices. Osquery is mainly for system admins — it allows users to search for process details and manage other parts of the system using SQL queries. Facebook stated:
Today, we’re excited to aounce the availability of an osquery developer kit for Windows! Security teams can now build customized osquery solutions for their Windows networks. In 2014, Facebook open sourced osquery, an SQL-powered detection tool for Linux and OS X that provides real-time insight into the state of corporate infrastructure. osquery allows you to write SQL-based queries that explore operating system data. With osquery, SQL tables represent abstract concepts such as ruing processes, loaded kernel modules, open network coections, browser plugins, hardware events or file hashes. Having timely, reliable visibility into operations ruing throughout your network is critical to quickly identify and investigate anomalies.
Facebook’s OSquery is only available for those on Windows 10. If you are interested in trying out Osquery, you can find the documentation for getting started on Windows 10 here.