deploying-osquery-for-endpoint-monitoring

# Deploying Osquery for Endpoint Monitoring ## When to Use Use this skill when: - Deploying osquery across Windows, macOS, and Linux endpoints for fleet-wide visibility - Building threat hunting queries using osquery's SQL interface - Monitoring endpoint compliance (installed software, open ports, running services) - Integrating osquery data with SIEM or Kolide/Fleet for centralized management **Do not use** for real-time alerting (osquery is periodic/on-demand; use EDR for real-time). ## Prerequisites - Osquery package for target OS (https://osquery.io/downloads) - Fleet management server (Kolide Fleet or FleetDM) for enterprise deployment - TLS certificates for secure agent-to-server communication - Log aggregation pipeline (Filebeat, Fluentd) for osquery result logs ## Workflow ### Step 1: Install Osquery ```bash # Ubuntu/Debian export OSQUERY_KEY=1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $OSQUERY_KEY add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main' apt-get update && apt-get install osquery -y # Windows (MSI) # Download from https://osquery.io/downloads/official msiexec /i osquery-5.12.1.msi /quiet # macOS brew install osquery ``` ### Step 2: Configure Osquery ```json // /etc/osquery/osquery.conf (Linux/macOS) or C:\ProgramData\osquery\osquery.conf { "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", ...