Awesome Detection Engineering
Section: Logging, Monitoring & Data Sources · A SQL-powered operating system instrumentation, monitoring, and analytics framework that exposes OS data as relational tables for querying and detection.
FreshScore 78
Entry
osquery
Appears in 5 awesome lists
Easily ask questions about your Linux and macOS infrastructure using a SQL-like query language; the provided incident-response pack helps you detect and respond to breaches.
Found in these lists
Awesome Incident Response
Section: All-In-One Tools · Easily ask questions about your Linux and macOS infrastructure using a SQL-like query language; the provided incident-response pack helps you detect and respond to breaches.
ActiveScore 82
Awesome JVM
Section: Profilers · osquery is an instrumentation framework that expose the operating system as a high-performance relational database.
StaleScore 51
Awesome Threat Detection and Hunting
Section: Endpoint Monitoring · (github) - SQL powered operating system instrumentation, monitoring, and analytics
SlowScore 61
Table of Contents
Section: Security · Query your servers status and info using a SQL like interface.
SlowScore 61
Often listed next to it
Cynative
🟢 — Local AI security research agent for cloud, code, and runtime environments across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes, with read-only action gates, sandboxed code execution, evidence-backed verification, and audit logs. · updated 2026-08-14); Related: Fraim · EscalateGPT
In 6 listsDetails
GRR Rapid Response
Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRR provides an API client library in…
In 6 listsDetails
Fleet device management
State of the art host monitoring platform tailored for security experts. Leveraging Facebook's battle-tested osquery project, Fleetdm delivers continuous updates, features and fast answers to big questions.
In 4 listsDetails
zipkin
Zipkin is a distributed tracing system. It helps gather timing data needed to troubleshoot latency problems in microservice architectures. License: Apache 2 , .
In 4 listsDetails
Velociraptor
Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
In 5 listsDetails
JITWatch
Log analyser / visualiser for Java HotSpot JIT compiler. Inspect inlining decisions, hot methods, bytecode, and assembly. View results in the JavaFX user interface. License: BSD 2, .
In 3 lists
Redline
Provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.
In 4 lists
CimSweep
A suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows
In 4 lists