Facebook's popular osquery project is now available for Windows after its launch in 2014 with support only for Mac OS X, Ubuntu, and CentOS.
If you're not familiar with the project, osquery is a tool beloved by both system administrators and network administrators, as well as security engineers.
osquery queries on that operating system using an easy-to-read and easy-to-learn language, such as SQL. The osquery code looks something like this:
[su_box title=”osquery ” style=”soft” box_color=”#f6f9f8″ title_color=”##6c6c6c”]SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid;
SELECT * FROM kernel_extensions WHERE name NOT LIKE 'com.apple.%' AND name != '__kernel__';
SELECT name, path, bundle_version, applescript_enabled FROM apps ;
SELECT uid, name FROM listening_ports l, processes p WHERE l.pid=p.pid;[/su_box]
So, there is a tangible benefit to working with osquery, rather than working with low-level C APIs.
Osquery, which organizes basic operating system components such as SQL tables, has been deployed in networking monitoring systems around the world, in data centers, as well as in private enterprise networks.
The toolkit allows developers to write monitoring rules and then track activity levels. If something goes terribly wrong, the system administrator is notified. This applies to both technical flaws and malicious intrusions.
If you still don't understand why osquery is useful, Facebook's Nick Anderson explains how the company uses it within its internal network.
“osquery allows our Facebook security team to pull data about all browser extensions running on our corporate network. We then compare this information with threat intelligence data to quickly identify malicious extensions and remove them.”
Based on GitHub statistics, osquery was the most popular security-related repo on the site. Now, with Windows support, its adoption and popularity are sure to skyrocket.
In addition to Windows, Mac OS X, Ubuntu, and CentOS, Facebook has added support for RHEL, Debian, and FreeBSD in the past two years. Facebook has hired security software company Trail of Bits to help bring osquery to Windows.
